Packages / moment / Security

HighVulnerabilityGHSA-446m-mv8f-q348CVE-2017-18214Published 5 Mar 2018

Regular Expression Denial of Service in moment

Affected · moment

  • < 2.19.3

Fixed in

2.19.3

npm install moment@2.19.3

  1. Affected

    1.0.0 – 2.19.2

    55 releases

  2. Fixed

    2.19.3 – 2.31.0

    25 releases, latest

80 stable releases of moment, oldest to newest.

What happens

Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.

Recommendation

Update to version 2.19.3 or later.