Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 2.31.0 | Safe from 2.31.0 | |
| 1.7.2 | 3 open advisories, worst high · last release Oct 2012, no longer updated |
- HighMoment.js vulnerable to Inefficient Regular Expression ComplexityGHSA-wc69-rhjr-hc9g · 6 Jul 2022
- 2.x2.18.0 – 2.29.3Fixed in 2.29.4
- HighPath Traversal: 'dir/../../filename' in moment.localeGHSA-8hfj-j24r-96c4 · 4 Apr 2022
- 2.x2.0.0 – 2.29.1Fixed in 2.29.2
- 1.x1.0.0 – 1.7.2No fix on 1.x · move to 2.29.2
- HighRegular Expression Denial of Service in momentGHSA-446m-mv8f-q348 · 5 Mar 2018
- 2.x2.0.0 – 2.19.2Fixed in 2.19.3
- 1.x1.0.0 – 1.7.2No fix on 1.x · move to 2.19.3
- Moderatemoment vulnerable to Path Traversal via crafted non-string locale nameGHSA-4p3w-j4w9-5jqw · 29 Sept 2026
- 2.x2.29.2 – 2.30.1Fixed in 2.31.0
- ModerateRegular Expression Denial of Service in momentGHSA-87vv-r9j6-g5qv · 24 Oct 2017
- 2.x2.0.0 – 2.11.1Fixed in 2.11.2
- 1.x1.0.0 – 1.7.2No fix on 1.x · move to 2.11.2
Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.