CVE-2026-17495
CVE-2026-17495 is a medium-severity vulnerability with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-27.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- EPSS exploit prediction: 0% (27th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-27
- Published:
- Last modified:
Description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
Frequently asked questions
- What is CVE-2026-17495?
- moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
- How severe is CVE-2026-17495?
- CVE-2026-17495 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2026-17495 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-17495?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-17495 published?
- CVE-2026-17495 was published on 2026-09-15 and last updated on 2026-09-16.
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
Other CWE-27 vulnerabilities
- CVE-2024-21896 — Critical (CVSS 9.8): The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the…
- CVE-2025-10438 — High (CVSS 8.6): Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical…
- CVE-2025-58761 — High (CVSS 8.6): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in…
- CVE-2024-24809 — High (CVSS 8.5): Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted…
- CVE-2026-76344 — High (CVSS 7.7): In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"…
- CVE-2024-43658 — High (CVSS 7.2): Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary…