PT-2017-8452 · Moment.Js+2 · Moment+2

Published 2017-01-23 · Updated 2026-06-04 · CVE-2016-4055

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions moment versions prior to 2.11.2

Description The duration function in the moment package allows remote attackers to cause a denial of service (CPU consumption) via a long string, also known as a "regular expression Denial of Service (ReDoS)". This issue is triggered when arbitrary user input is passed into moment.duration().

Recommendations For moment versions prior to 2.11.2, please update to version 2.11.2 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2016-4055

GHSA-87VV-R9J6-G5QV

GHSA-HXF5-MG84-PJ4M

USN-4786-1

Affected Products

Jira

Ubuntu

Moment

References · 31

• 🔥 https://nodesecurity.io/advisories/55 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4055 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4055 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18214 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2016-4055 · Vendor Advisory
• https://tenable.com/security/tns-2019-02 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4055 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Patch
• https://osv.dev/vulnerability/GHSA-87vv-r9j6-g5qv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4055 · Security Note
• https://ubuntu.com/security/notices/USN-4786-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4055 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hxf5-mg84-pj4m · Vendor Advisory
• https://osv.dev/vulnerability/USN-4786-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4055 · Vendor Advisory