{"answers":{"affected":"4 open source packages ship an affected version, including Moment.js and moment. It affects 3 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31129 exists.","fix":"Upgrade Moment.js to 2.29.4 or later.","what":"CVE-2022-31129 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-31129 and fix it if it is affected.\n\nWhat it is: CVE-2022-31129 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31129 exists.\n\nAffected packages and fixed versions:\n- Moment.js (NuGet): affected from 2.18.0; fixed in 2.29.4\n- Moment.js (NuGet): affected from 2.18.0; fixed in 2.29.4\n- moment (npm): affected from 2.18.0; fixed in 2.29.4\n- moment (npm): affected from 2.18.0; fixed in 2.29.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-31129/ (Markdown: https://insights.sbomify.com/CVE-2022-31129/index.md)","id":"CVE-2022-31129","markdown":"https://insights.sbomify.com/CVE-2022-31129/index.md","name":"CVE-2022-31129","record":{"aliases":["DEBIAN-CVE-2022-31129","GHSA-wc69-rhjr-hc9g","RHSA-2022:6392","ROOT-APP-NPM-CVE-2022-31129","UBUNTU-CVE-2022-31129"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript date library","requires_auth":"none","summary":"Attackers can cause denial of service via ReDoS by providing long strings to the moment.js date parsing function.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"fedora","vendor":"fedoraproject"},{"product":"moment","vendor":"momentjs"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.","ecosystems":["NuGet","Red Hat:rhev_hypervisor:4.4::el8","npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Inefficient Regular Expression Complexity in moment","id":"CVE-2022-31129","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"NuGet","product":"debian:debian_linux","products":["debian:debian_linux","fedoraproject:fedora"],"type":"denial_of_service","year":"2022"},"n_packages":6,"n_references":10,"next":{"headline":"Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins","id":"CVE-2022-31130"},"packages":[{"ecosystem":"NuGet","fixed":["2.29.4"],"introduced":["2.18.0"],"last_affected":[],"package":"Moment.js","purl":null,"source":"GHSA-wc69-rhjr-hc9g"},{"ecosystem":"NuGet","fixed":["2.29.4"],"introduced":["2.18.0"],"last_affected":[],"package":"Moment.js","purl":"pkg:nuget/Moment.js","source":"GHSA-wc69-rhjr-hc9g"},{"ecosystem":"npm","fixed":["2.29.4"],"introduced":["2.18.0"],"last_affected":[],"package":"moment","purl":null,"source":"GHSA-wc69-rhjr-hc9g"},{"ecosystem":"npm","fixed":["2.29.4"],"introduced":["2.18.0"],"last_affected":[],"package":"moment","purl":"pkg:npm/moment","source":"GHSA-wc69-rhjr-hc9g"},{"ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","fixed":["0:0.16.2-1.el8ev"],"introduced":["0"],"last_affected":[],"package":"cockpit-ovirt","purl":"pkg:rpm/redhat/cockpit-ovirt","source":"RHSA-2022:6392"},{"ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","fixed":["0:0.16.2-1.el8ev"],"introduced":["0"],"last_affected":[],"package":"cockpit-ovirt-dashboard","purl":"pkg:rpm/redhat/cockpit-ovirt-dashboard","source":"RHSA-2022:6392"}],"prev":{"headline":"Fine grained permissions are not checked in Tuleap","id":"CVE-2022-31128"},"products":["moment"],"published":"2022-07-06","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-03","vendors":["moment"]},"summary":"Attackers can cause denial of service via ReDoS by providing long strings to the moment.js date parsing function.","url":"https://insights.sbomify.com/CVE-2022-31129/"}