moment vulnerable to Path Traversal via crafted non-string locale name

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-17495 · Microsoft / collected KEV context

EUVD-2026-78277

GHSA-4p3w-j4w9-5jqw

cve-program · CVE-2026-17495

• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-78277

• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-17495

• https://cna.openjsf.org/security-advisories.html
• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw

osv · GHSA-4p3w-j4w9-5jqw

• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
• https://nvd.nist.gov/vuln/detail/CVE-2026-17495
• https://github.com/moment/moment/pull/6386
• https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
• https://cna.openjsf.org/security-advisories.html
• https://github.com/moment/moment
• https://github.com/moment/moment/releases/tag/2.31.0

No related operational record is retained in the current change model.