CVE-2026-17495 in moment
Summary
by MITRE • 09/15/2026
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as CVE-2024-21539 represents a significant security flaw within the Moment.js library, specifically affecting versions ranging from 2.29.2 through 2.30.1. This issue stems from an incomplete remediation of a previous path traversal vulnerability documented in CVE-2022-24785. The core technical defect lies in the implementation of the locale-name path-traversal guard within the moment.locale() function. During its execution, this security check operates under the assumption that all incoming arguments are strictly strings. Consequently, it performs validation checks on string representations or specific method behaviors without enforcing strict type checking for non-string objects. This architectural oversight creates a bypass vector where an attacker can exploit JavaScript's dynamic typing and object coercion mechanisms to circumvent intended security controls.
The operational mechanism of this exploitation involves passing a specially crafted non-string object as the argument to moment.locale(). The malicious payload is designed such that its match() method returns a value that satisfies the existing regex-based or string-comparison checks used by the library's guard. Simultaneously, when JavaScript implicitly converts this object to a string for internal processing, its toString() method returns a path traversal sequence, typically involving dot-dot-slash sequences like ../. Because the initial validation passed due to the match() behavior, and the subsequent require() call utilizes the coerced string value derived from toString(), the library proceeds to load an arbitrary module specified by the attacker. This effectively allows for Arbitrary File Read or potentially Remote Code Execution if combined with other vulnerabilities in the host environment, as Node.js will attempt to resolve and execute modules based on these untrusted path segments.
This vulnerability primarily impacts server-side applications utilizing npm that accept user-provided input directly into moment.locale() without rigorous type validation. The impact is severe because it undermines the integrity of module loading mechanisms within Node.js environments. An attacker who can control the locale parameter, whether through direct API inputs or indirectly via configuration files processed by the application, can manipulate which internal or external modules are loaded. This could lead to information disclosure if sensitive local files are read, or more critically, code execution if an attacker can influence module resolution paths in a way that loads maliciously crafted JavaScript files from accessible directories. The severity is compounded by the fact that this was intended as a fix for a prior issue, suggesting that developers may have assumed the vulnerability class was fully addressed in intermediate versions.
From a classification perspective, this flaw aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection or CWE-94 Code Injection depending on the specific outcome of the module loading process. In terms of offensive security frameworks, it relates to ATT&CK technique T1553 Subvert Trust Controls, specifically bypassing code signing or integrity checks through input manipulation, although more accurately it fits under path traversal patterns often associated with file inclusion vulnerabilities. The root cause is a failure to enforce strict type constraints on function arguments before performing critical security operations like module resolution.
To mitigate this risk, organizations must immediately upgrade the Moment.js dependency to version 2.31.0 or later, where the input validation logic has been corrected to properly handle non-string inputs and prevent path traversal via object coercion. For environments that cannot yet be upgraded due to legacy constraints, a critical workaround involves implementing strict type checking before invoking moment.locale(). Developers should validate that any user-supplied input is strictly of string type using methods such as typeof or Object.prototype.toString.call() before passing it to the library function. Additionally, applying general best practices for securing Node.js applications, including restricting file system access permissions and validating all external inputs against a whitelist of allowed values where possible, will further reduce the attack surface associated with this vulnerability class.