CVE-2016-4055 in Primavera Unifier
Summary
by MITRE
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/14/2026
The vulnerability identified as CVE-2016-4055 represents a critical regular expression denial of service flaw within the moment package version 2.11.2 and earlier for Node.js environments. This issue stems from the duration function's inadequate handling of input validation, creating a pathway for malicious actors to exploit CPU resource exhaustion through carefully crafted long strings. The moment package serves as a widely adopted JavaScript library for date and time manipulation, making this vulnerability particularly dangerous as it affects numerous applications that depend on date processing capabilities. The flaw specifically manifests when the duration function processes malformed input strings, causing the regular expression engine to enter into catastrophic backtracking scenarios that consume excessive computational resources.
The technical implementation of this vulnerability involves the moment package's duration parsing logic, which employs regular expressions to interpret time duration strings. When an attacker provides a maliciously constructed string that triggers the regular expression engine's backtracking behavior, the system experiences exponential time complexity growth during pattern matching operations. This occurs because the regular expression contains nested quantifiers that create numerous potential match paths, leading to the CPU consumption spike that constitutes the denial of service. The vulnerability is classified under CWE-400 as a Regular Expression Denial of Service, which specifically addresses the security risk of exponential time complexity in regular expression processing. The attack vector operates through the standard input processing pathways of Node.js applications, making it particularly challenging to detect and prevent without proper input sanitization measures.
The operational impact of CVE-2016-4055 extends beyond simple service disruption to potentially compromise entire application availability and system stability. When exploited, the vulnerability can cause applications to consume 100% CPU resources for extended periods, effectively rendering the affected services unusable to legitimate users. This type of attack falls under the ATT&CK technique T1499.004 for Network Denial of Service, where attackers leverage application-level vulnerabilities to exhaust system resources. The widespread adoption of the moment package across Node.js applications means that exploitation could affect numerous web services, APIs, and backend systems that process user-provided time duration inputs. Organizations relying on these vulnerable libraries may experience cascading failures as the CPU exhaustion propagates through system components, potentially leading to complete service outages and significant business disruption.
Mitigation strategies for CVE-2016-4055 require both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities. The primary solution involves upgrading to moment package version 2.11.2 or later, which includes fixed regular expression patterns that eliminate the backtracking scenarios. Organizations should implement comprehensive input validation and sanitization procedures that limit string length and enforce strict format constraints before processing any user-provided duration data. Additionally, implementing rate limiting and resource monitoring can help detect and prevent exploitation attempts before they cause significant damage. Security teams should conduct regular vulnerability assessments of their Node.js dependencies and maintain updated security tooling to identify similar patterns in other third-party libraries. The remediation process should also include thorough testing of patched applications to ensure that the fix does not introduce regressions in functionality while maintaining the necessary security protections against future ReDoS attacks.