VulnSocial

CVE-2026-17495Patch

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-27

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-15); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-15: 1Mentions · 2026-09-30: 1Mentions · 2026-10-06: 1Patch / Workaround · 2026-09-15: 1Patch / Workaround · 2026-10-06: 1Technical Details · 2026-09-15: 1Technical Details · 2026-09-30: 1Technical Details · 2026-10-06: 109-1509-3010-06
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-151
Patch1
2026-09-301
Disclosure1
2026-10-061
Patch1
Full discourse3 posts
  • Ulises Gascón@kom_256
    Patch

    🚨 Medium-severity security fix in moment@2.31.0 just released! Patches CVE-2026-17495: moment vulnerable to Path Traversal via crafted non-string locale name https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw

    Post summary

    The post announces a released security fix for CVE-2026-17495 in [email protected]. It also briefly describes the vulnerability as path traversal via a crafted non-string locale name, but the main takeaway is the patch/advisory.

    01020231
    5.5K followersView on X
  • OpenEffect@openeffectd
    Patch

    Security advisory for moment (#29 in npm's top 100). CVE-2026-17495 (moderate): moment vulnerable to Path Traversal via crafted non-string locale name 74% of last week's downloads (39.9M) went to affected versions. Update to 2.31.0 or later. https://github.com/advisories/GHSA-4p3w-j4w9-5jqw https://t.co/NryH1KfB4G

    Post summary

    The tweet serves as a security advisory for CVE-2026-17495 in the moment.js library, detailing a moderate Path Traversal vulnerability and explicitly urging users to update to version 2.31.0 or later.

    0001084
    91 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🟠 moment, Path Traversal, #CVE-2026-17495 (Moderate) -DC-Sep2026-2651 https://dailycve.com/moment-path-traversal-cve-2026-17495-moderate-dc-sep2026-2651/

    Post summary

    This tweet announces CVE-2026-17495, a Moderate Path Traversal vulnerability in the 'moment' product, linking to a description page. It provides technical classification details but contains no evidence of PoCs, exploit tools, patches, or active exploitation.

    0000037
    239 followersView on X

Explore more

Back to dashboard