DEBIAN-CVE-2026-17495
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
DEBIAN-CVE-2026-17495
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-17495
node-moment
Source reference: /affected/0/package/name
- Affected versions
- 2.29.4+ds-1
Source reference:
/affected/0/versions2.30.1+ds-1Source reference:
/affected/0/versions2.30.1+ds1-1Source reference:
/affected/0/versions2.30.1+ds1-2Source reference:
/affected/0/versions2.30.1+ds1-3Source reference:
/affected/0/versions2.31.0+ds1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
node-moment
Source reference: /affected/1/package/name
- Affected versions
- 2.29.4+ds-1
Source reference:
/affected/1/versions2.30.1+ds-1Source reference:
/affected/1/versions2.30.1+ds1-1Source reference:
/affected/1/versions2.30.1+ds1-2Source reference:
/affected/1/versions2.30.1+ds1-3Source reference:
/affected/1/versions2.31.0+ds1-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
node-moment
Source reference: /affected/2/package/name
- Affected versions
- 2.29.4+ds-1
Source reference:
/affected/2/versions2.30.1+ds-1Source reference:
/affected/2/versions2.30.1+ds1-1Source reference:
/affected/2/versions2.30.1+ds1-2Source reference:
/affected/2/versions2.30.1+ds1-3Source reference:
/affected/2/versions - Fixed versions
- 2.31.0+ds1-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-moment",
"purl": "pkg:deb/debian/node-moment?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.29.4+ds-1",
"2.30.1+ds-1",
"2.30.1+ds1-1",
"2.30.1+ds1-2",
"2.30.1+ds1-3",
"2.31.0+ds1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17495.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-moment",
"purl": "pkg:deb/debian/node-moment?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.29.4+ds-1",
"2.30.1+ds-1",
"2.30.1+ds1-1",
"2.30.1+ds1-2",
"2.30.1+ds1-3",
"2.31.0+ds1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17495.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.31.0+ds1-1"
}
]
}
],
"package": {
"name": "node-moment",
"purl": "pkg:deb/debian/node-moment?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.29.4+ds-1",
"2.30.1+ds-1",
"2.30.1+ds1-1",
"2.30.1+ds1-2",
"2.30.1+ds1-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17495.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56155 · Revision 1
- Added to Heist Feed
- Publisher date