CVE catalog

CVE-2022-24785

node-moment: CVE-2022-24785

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
13.84% · Oct 25, 2026

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-momentsid2.31.0+ds1-1fixed
Debiannode-momentforky2.31.0+ds1-1fixed
Debiannode-momenttrixie2.29.4+ds-1fixed
Debiannode-momentbookworm2.29.4+ds-1fixed
Ubuntunode-moment18.042.18.1+ds-1vulnerable
Ubuntunode-moment18.042.19.1+ds-1vulnerable
Ubuntunode-moment18.042.19.2+ds-1vulnerable
Ubuntunode-moment18.042.19.3+ds-1vulnerable
Ubuntunode-moment18.042.19.4+ds-1vulnerable
Ubuntunode-moment18.042.20.1+ds-1vulnerable
Ubuntunode-moment18.042.20.1+ds-1ubuntu0.1fixed
Ubuntunode-moment20.042.24.0+ds-1vulnerable
Ubuntunode-moment20.042.24.0+ds-2vulnerable
Ubuntunode-moment20.042.24.0+ds-2ubuntu0.1fixed
Ubuntunode-moment22.042.29.1+ds-2vulnerable
Ubuntunode-moment22.042.29.1+ds-3vulnerable
Ubuntunode-moment22.042.29.1+ds-3ubuntu0.2fixed
Ubuntunikola16.047.6.0-3vulnerable
Ubuntunikola16.047.6.4-1vulnerable
Ubuntunode-momentpro2.10.6+dfsg-1vulnerable
Ubuntunode-momentpro2.11.0+ds-1vulnerable
Ubuntunode-momentpro2.11.0+ds-1ubuntu0.1~esm1vulnerable
Ubuntunode-moment18.042.18.1+ds-1vulnerable
Ubuntunode-moment18.042.19.1+ds-1vulnerable
Ubuntunode-moment18.042.19.2+ds-1vulnerable
Ubuntunode-moment18.042.19.3+ds-1vulnerable
Ubuntunode-moment18.042.19.4+ds-1vulnerable
Ubuntunode-moment18.042.20.1+ds-1vulnerable
Ubuntunode-moment18.042.20.1+ds-1ubuntu0.1fixed
Ubuntunode-moment20.042.24.0+ds-1vulnerable
Ubuntunode-moment20.042.24.0+ds-2vulnerable
Ubuntunode-moment20.042.24.0+ds-2ubuntu0.1fixed
Ubuntunode-moment22.042.29.1+ds-2vulnerable
Ubuntunode-moment22.042.29.1+ds-3vulnerable
Ubuntunode-moment22.042.29.1+ds-3ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-momentsourcesid2.29.2+ds-1not yet assignedNot reported[1009327]
Debiannode-momentsourceforky2.29.2+ds-1not yet assignedNot reported[1009327]
Debiannode-momentsourcetrixie2.29.2+ds-1not yet assignedNot reported[1009327]
Debiannode-momentsourcebookworm2.29.2+ds-1not yet assignedNot reported[1009327]
Ubuntunode-momentdeb18.042.20.1+ds-1ubuntu0.1Not reportedUSN-5559-1Not reported
Ubuntunode-momentdeb20.042.24.0+ds-2ubuntu0.1Not reportedUSN-5559-1Not reported
Ubuntunode-momentdeb22.042.29.1+ds-3ubuntu0.2Not reportedUSN-5559-1Not reported
Ubuntunode-momentdeb18.042.20.1+ds-1ubuntu0.1Not reportedUBUNTU-CVE-2022-24785Not reported
Ubuntunode-momentdeb20.042.24.0+ds-2ubuntu0.1Not reportedUBUNTU-CVE-2022-24785Not reported
Ubuntunode-momentdeb22.042.29.1+ds-3ubuntu0.2Not reportedUBUNTU-CVE-2022-24785Not reported

[Debian bug #1009327]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjs-moment]Fixed

    Source package: [node-moment]

    Details (2)

    • 2.29.4+ds-1 · all · bookworm

      Fixed · Fixed: 2.29.2+ds-1

      dsa · node-moment · debian · bookworm

    • 2.29.4+ds-1 · all · bookworm

      Fixed · Fixed: 2.29.2+ds-1

      dsa · node-moment · debian · bookworm

  • [node-moment]Fixed
    Details (2)

    • 2.29.4+ds-1 · all · bookworm

      Fixed · Fixed: 2.29.2+ds-1

      dsa · node-moment · debian · bookworm

    • 2.29.4+ds-1 · all · bookworm

      Fixed · Fixed: 2.29.2+ds-1

      dsa · node-moment · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]