CVE-2026-17495 Overview
CVE-2026-17495 is a path traversal vulnerability [CWE-27] in the moment JavaScript date library. The flaw affects versions 2.29.2 through 2.30.1 and represents an incomplete fix for CVE-2022-24785. Attackers can bypass the locale-name path-traversal guard in moment.locale() by passing a non-string object that defines a malicious match() method and a toString() returning a traversal path. The crafted object reaches an internal require() call with attacker-controlled path segments. The vulnerability primarily affects server-side npm consumers that pass user-supplied input directly to moment.locale().
Critical Impact
Server-side Node.js applications forwarding untrusted input to moment.locale() may load arbitrary modules from the filesystem through path traversal, compromising application integrity.
Affected Products
- moment.js version 2.29.2
- moment.js versions 2.29.3 through 2.29.4
- moment.js version 2.30.1
Discovery Timeline
- 2026-09-15 - CVE-2026-17495 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-17495
Vulnerability Analysis
The vulnerability resides in the locale loading logic of moment.js. The guard added to remediate CVE-2022-24785 was designed to reject locale identifiers that contain path traversal sequences. However, the guard assumes the input parameter is a JavaScript string and relies on calling match() against it.
When an attacker supplies a non-string object that implements a match() method returning values that satisfy the guard, the check succeeds. The value is later coerced to a string through toString(), which returns an attacker-controlled path such as ../../etc/target. The coerced value is then concatenated into an internal require() call, loading an unintended module from the filesystem.
The issue is classified as Path Traversal [CWE-27]. Exploitation requires the attacker to control the argument passed to moment.locale() and to place or reference a loadable module along the traversal path.
Root Cause
The root cause is an input validation weakness. The guard performs its safety check on one representation of the input (match()) while a different representation (toString()) is used at the require() sink. This mismatch enables a Time-of-Check to Time-of-Use style bypass through JavaScript's duck-typed method dispatch.
Attack Vector
The vector is network-reachable but requires high attack complexity. An application must forward untrusted, structured input directly to moment.locale() without validating that the argument is a string. Frameworks that parse JSON bodies into objects and pass parsed values to locale selection are the most exposed. The attacker crafts an object whose match method returns benign data and whose toString returns a traversal path pointing to a module the attacker can influence.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-4p3w-j4w9-5jqw and the OpenJSF Security Advisories. No public exploit code is verified at this time.
Detection Methods for CVE-2026-17495
Indicators of Compromise
- Unexpected calls to require() originating from the moment.js locale loader with paths containing ../ sequences.
- Runtime errors or stack traces referencing moment/src/lib/locale/locales.js combined with filesystem access outside the node_modules/moment/locale/ directory.
- Application logs showing non-string object payloads reaching request handlers that call moment.locale().
Detection Strategies
- Perform software composition analysis (SCA) across build pipelines to flag moment.js versions 2.29.2 through 2.30.1.
- Enable Node.js filesystem auditing or eBPF-based process telemetry to identify anomalous module loads from the moment process context.
- Review application code for direct forwarding of req.body, req.query, or req.params values into moment.locale() without a typeof check.
Monitoring Recommendations
- Monitor outbound require() calls and unusual file reads outside expected locale directories.
- Alert on JSON request bodies containing object-valued fields where a string is expected by downstream handlers.
- Correlate web application firewall (WAF) logs for traversal patterns targeting locale-selection endpoints.
How to Mitigate CVE-2026-17495
Immediate Actions Required
- Upgrade moment.js to version 2.31.0 or later across all Node.js services.
- Audit application code paths that invoke moment.locale() and reject non-string inputs at the boundary.
- Rebuild and redeploy container images and serverless artifacts that bundle vulnerable moment.js versions.
Patch Information
The issue is fixed in moment.js 2.31.0. Consumers should update their package.json dependency ranges and regenerate lockfiles. Refer to the GitHub Security Advisory GHSA-4p3w-j4w9-5jqw for the full remediation notice.
Workarounds
- Validate that any user-supplied input is a string using typeof value === 'string' before passing it to moment.locale().
- Maintain an allowlist of accepted locale identifiers and reject values outside that list.
- Constrain the runtime filesystem view of Node.js processes so that traversal outside the node_modules directory is not possible.
# Upgrade moment.js to the patched version
npm install moment@^2.31.0
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
