{"schema_version":"1.9.0","id":"GHSA-wc69-rhjr-hc9g","published":"2022-07-06T18:38:49Z","modified":"2026-09-10T03:49:45.131249858Z","aliases":["CVE-2022-31129"],"related":["CVE-2023-22467"],"summary":"Moment.js vulnerable to Inefficient Regular Expression Complexity","details":"### Impact\n\n* using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs\n* noticeable slowdown is observed with inputs above 10k characters\n* users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks\n\n### Patches\nThe problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking.\n\n### Workarounds\nIn general, given the proliferation of ReDoS attacks, it makes sense to limit the length of the user input to something sane, like 200 characters or less. I haven't seen legitimate cases of date-time strings longer than that, so all moment users who do pass a user-originating string to constructor are encouraged to apply such a rudimentary filter, that would help with this but also most future ReDoS vulnerabilities.\n\n### References\nThere is an excellent writeup of the issue here: https://github.com/moment/moment/pull/6015#issuecomment-1152961973=\n\n### Details\nThe issue is rooted in the code that removes legacy comments (stuff inside parenthesis) from strings during rfc2822 parsing. `moment(\"(\".repeat(500000))` will take a few minutes to process, which is unacceptable.","affected":[{"package":{"name":"moment","ecosystem":"npm","purl":"pkg:npm/moment"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.18.0"},{"fixed":"2.29.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-wc69-rhjr-hc9g/GHSA-wc69-rhjr-hc9g.json"}},{"package":{"name":"Moment.js","ecosystem":"NuGet","purl":"pkg:nuget/Moment.js"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.29.4"}]}],"versions":["2.18.0","2.18.1","2.18.2","2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.1","2.21.0","2.22.0","2.22.1","2.22.2","2.23.0","2.24.0","2.25.0","2.25.1","2.25.2","2.26.0","2.27.0","2.28.0","2.29.0","2.29.1","2.29.2","2.29.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-wc69-rhjr-hc9g/GHSA-wc69-rhjr-hc9g.json"}}],"references":[{"type":"WEB","url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129"},{"type":"WEB","url":"https://github.com/moment/moment/pull/6015#issuecomment-1152961973"},{"type":"WEB","url":"https://github.com/moment/moment/pull/6015/commits/4bbb9f3ccbe231de40207503f344fe5ce97584f4"},{"type":"WEB","url":"https://github.com/moment/moment/pull/6015/commits/bfd4f2375d5c1a2106246721d693a9611dddfbfe"},{"type":"WEB","url":"https://github.com/moment/moment/pull/6015/commits/dc0d180e90d8a84f7ff13572363330a22b3ea504"},{"type":"WEB","url":"https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241108-0002"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20221014-0003"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html"},{"type":"WEB","url":"https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633"},{"type":"PACKAGE","url":"https://github.com/moment/moment"}],"database_specific":{"cwe_ids":["CWE-1333","CWE-400"],"github_reviewed":true,"github_reviewed_at":"2022-07-06T18:38:49Z","nvd_published_at":"2022-07-06T18:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}