{"id":"EUVD-2026-78277","enisaUuid":"c8fa8e6c-fc31-3c4c-bc5e-417c9fb9b4b7","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().","datePublished":"Sep 15, 2026, 5:40:55 AM","dateUpdated":"Sep 15, 2026, 5:49:57 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw\nhttps://cna.openjsf.org/security-advisories.html\n","aliases":"CVE-2026-17495\nGHSA-4p3w-j4w9-5jqw\n","assigner":"openjs","epss":0.52,"enisaIdProduct":[{"id":"fedf7d12-c139-35d2-a0ee-6cb90f983ade","product":{"name":"moment","vendor":{"name":"moment"}},"product_version":"2.29.2 \u003c2.31.0"}],"enisaIdVendor":[{"id":"e4750045-3815-3f8f-a34f-e1d857baf8e2","vendor":{"name":"moment"}}],"enisaIdVulnerability":[{"id":"397f528d-eb57-3daa-b645-0031f17f5f6b","vulnerability":{"id":"CVE-2026-17495","description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().","datePublished":"Sep 15, 2026, 5:40:55 AM","dateUpdated":"Sep 15, 2026, 5:49:57 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw\nhttps://cna.openjsf.org/security-advisories.html\n","enisa_id":"EUVD-2026-78277\n","assigner":"openjs","epss":0.52,"dataProcessed":"Nov 11, 2026, 7:26:12 AM","vulnerabilityProduct":[{"id":"81649fe5-f732-3adf-852b-16493b28cad0","product":{"name":"moment","vendor":{"name":"moment"}},"product_version":"2.29.2 \u003c2.31.0"}],"vulnerabilityVendor":[{"id":"df848a6c-7254-32df-88a0-78ac68285c5e","vendor":{"name":"moment"}}]}},{"id":"fd8a0047-3f3c-3cb9-8a6e-306b97db35e3","vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","description":"moment vulnerable to Path Traversal via crafted non-string locale name","datePublished":"Sep 29, 2026, 11:46:02 PM","dateUpdated":"Sep 29, 2026, 11:46:02 PM","baseScore":0.0,"references":"https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17495\nhttps://github.com/moment/moment/pull/6386\nhttps://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/moment/moment\nhttps://github.com/moment/moment/releases/tag/2.31.0\n","enisa_id":"EUVD-2026-78277\n","aliases":"CVE-2026-17495\nGHSA-4p3w-j4w9-5jqw\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}