CVE-2026-17495
Received Received - Intake

Path Traversal in Moment.js Date Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: openjs

Description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-17495
EUVD
EUVD-2026-78277

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
moment moment From 2.29.2 (inc) to 2.30.1 (inc)
moment moment 2.31.0
moment moment From 2.29.2 (inc) to 2.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-27 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17495 is a path traversal vulnerability in the Moment.js library affecting versions 2.29.2 through 2.30.1. It allows attackers to bypass locale-name validation by passing a crafted non-string object to moment.locale(). The object's match() method passes checks while its toString() returns a traversal path, enabling require() to load files from attacker-controlled paths. This bypasses a previous fix for CVE-2022-24785 and primarily impacts server-side npm users.

Detection Guidance

To detect this vulnerability, check if your system uses Moment.js versions between 2.29.2 and 2.30.1. Run: npm list moment or grep -R "moment" package.json in your project directories. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

If you use Moment.js versions 2.29.2 to 2.30.1 in a server-side environment and pass user-provided input directly to moment.locale(), an attacker could manipulate file paths to load unauthorized files. This could lead to code execution or data exfiltration. Plain string inputs are not vulnerable. The impact is limited to integrity due to potential unauthorized file access.

Compliance Impact

This vulnerability could compromise compliance by allowing unauthorized file access, potentially exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Unauthorized file access may violate these regulations, leading to legal and financial penalties. Users should upgrade to version 2.31.0 or later to mitigate risks.

Mitigation Strategies

Upgrade Moment.js to version 2.31.0 or later immediately. If upgrading is not possible, validate all user-supplied input to ensure it is a string before passing it to moment.locale().

Remove or restrict direct user input to moment.locale() to prevent path traversal attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart