7.5

CVE-2022-31129: Inefficient Regular Expression Complexity in moment

Modified
AliasesRHSA-2022:6392UBUNTU-CVE-2022-31129DEBIAN-CVE-2022-31129
Published 06-07-2022Last modified 03-11-2025

Vulnerability summary

CVE-2022-31129 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 5.55% chance of exploitation in the next 30 days, higher than 92.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
5.55%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 17 · Related 8
DLA-3295-1MGASA-2022-0323MGASA-2024-0067RHSA-2022:6272RHSA-2022:6277RHSA-2022:6393

Timeline

  1. 06-07-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

5.55%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.55% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Moment

    Maturity: poc

  • referenceUnverified

    Exploit Reference (huntr.dev)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu11 products
  • gnucashAll versions (No fix recorded)
  • mediawikiAll versions (No fix recorded)
  • node-momentAll versions (No fix recorded) | < 2.20.1+ds-1ubuntu0.1 | < 2.24.0+ds-2ubuntu0.1 | < 2.29.1+ds-3ubuntu0.2
  • ntopngAll versions (No fix recorded)
  • odooAll versions (No fix recorded)
Chainguard2 products
  • wazuh-dashboard-security-plugin< 4.14.6-r5
  • wazuh-dashboard-security-plugin-fips< 4.14.6-r2
Debian2 products
Redhat2 products
  • cockpit-ovirt< 0:0.16.2-1.el8ev
  • cockpit-ovirt-dashboard< 0:0.16.2-1.el8ev
Fedoraproject1 product
Moment1 product
Momentjs1 product
Npm1 product
  • moment≥ 2.18.0, < 2.29.4
NuGet1 product
  • Moment.js≥ 2.18.0, < 2.29.4

9 vendors · 22 products

References

41 links
Show all 41 references