Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3295-1 node-moment security update
EUVD EUVD EUVD-2022-1677 Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Github GHSA Github GHSA GHSA-8hfj-j24r-96c4 Path Traversal: 'dir/../../filename' in moment.locale
Ubuntu USN Ubuntu USN USN-5559-1 Moment.js vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 04 Nov 2025 07:30:00 +0900

Type Values Removed Values Added
References

Sun, 13 Jul 2025 22:45:00 +0900

Type Values Removed Values Added
Metrics epss

{'score': 0.00539}

epss

{'score': 0.0068}


Mon, 05 May 2025 23:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7

Tue, 29 Apr 2025 00:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Thu, 24 Apr 2025 04:15:00 +0900

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 09 Sep 2024 03:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

Tue, 20 Aug 2024 07:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-11-03T21:46:06.689Z

Reserved: 2022-02-10T00:00:00.000Z

Link: CVE-2022-24785

cve-icon Vulnrichment

Updated: 2025-11-03T21:46:06.689Z

cve-icon NVD

Status : Modified

Published: 2022-04-04T17:15:07.583

Modified: 2025-11-03T22:15:57.280

Link: CVE-2022-24785

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-04-04T00:00:00Z

Links: CVE-2022-24785 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses