CVE-2022-31129

    Dashboard / Vulnerabilities / CVE-2022-31129

    CVE-2022-31129

    Published: 6 Jul 2022Last Modified: 21 Oct 2026

    Summary: Inefficient Regular Expression Complexity in moment

    Details: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

    References: https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31129.json, https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO/, https://nvd.nist.gov/vuln/detail/CVE-2022-31129, https://security.netapp.com/advisory/ntap-20221014-0003/, https://security.netapp.com/advisory/ntap-20241108-0002/, https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3, https://github.com/moment/moment/pull/6015#issuecomment-1152961973, https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f2af24d53ec8bb2ad61626509e529d339217ff96
    Fixed -000ac1800e620f770f4eb31b5ae908f6167b0ab2

    Affected versions

    2.29.2
    2.29.1
    2.29.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31129 | CVE-DB