moment vulnerable to Path Traversal via crafted non-string locale name

CVE-2026-17495 is a path-traversal bypass in moment.js's moment.locale() function affecting versions 2.29.2 through 2.30.x, fixed in 2.31.0. The original CVE-2022-24785 fix added string validation to locale names, but this new variant passes a crafted *non-string* value (e.g., an object or array with a toString() override) that slips past the check, allowing dir/../../filename-style traversal to load unintended locale files on server-side Node.js deployments. Browser-side usage is completely unaffected. Reporter: mattjohnsonpint.

The vendor rates this MEDIUM at 5.9, and even that feels generous. The CVSS vector (AC:H) already concedes the attack is hard to pull off — the application must take raw, unvalidated, non-string user input and funnel it directly into moment.locale(). In practice, almost no application does this. Locale selection is nearly always hardcoded, drawn from an allowlist, or coerced to a string long before moment ever sees it. The impact is integrity-only (C:N/I:H/A:N): you can trick the server into loading the wrong locale data file, but you cannot read arbitrary files or achieve code execution through this path alone. noisgate downgrades to LOW 3.0.

Why this verdict

• Friction — server-side only: moment.js's ~27M weekly npm downloads are overwhelmingly browser bundles and transitive dependencies. The locale *filesystem* path traversal only fires in Node.js server-side contexts, eliminating the vast majority of the install base.
• Friction — non-string input prerequisite: The application must pass an unvalidated, non-string (object/array) value directly into moment.locale(). Standard web frameworks coerce query parameters to strings; JSON body parsers could preserve objects, but any input validation layer (Joi, Zod, TypeScript strict mode) blocks this.
• Friction — AC:H acknowledged by vendor: The CVSS vector itself rates Attack Complexity as High, meaning even the vendor recognizes the conditions are unusual.
• Impact ceiling — integrity only, no RCE: C:N/I:H/A:N means the attacker can load wrong locale data but cannot read files or execute arbitrary code through this path alone. Chaining to RCE requires a *separate* file-upload vulnerability.
• Role multiplier: moment.js is a date-formatting utility library, not a high-value-role component (not a DC, hypervisor, IdP, PAM, backup agent, or network edge). Even when embedded in a CI/CD pipeline or production API server, this locale-loading traversal does not escalate to supply-chain pivot, domain takeover, or fleet compromise. No high-value-role floor applies.

Why not higher?

The MEDIUM vendor rating assumes a generic server-side Node.js deployment where user input reaches moment.locale() unchecked. In practice, the intersection of (a) server-side moment usage, (b) non-string user input reaching the locale API, and (c) no input validation is extremely rare. The integrity-only impact with no path to RCE or data exfiltration does not justify MEDIUM in a risk-prioritized enterprise queue.

Why not lower?

IGNORE would require that the vulnerability is entirely theoretical or affects no production code. Moment.js *is* used server-side in legacy Node.js applications, and JSON body parsers *can* deliver non-string objects. The traversal is real and reproducible under the right conditions, so documenting and eventually patching is appropriate — just not urgently.

1. Add type validation before moment.locale() calls — Insert a guard like if (typeof locale !== 'string') return; before any call to moment.locale(userInput). This is a one-line fix that neutralizes the bypass entirely. Deploy within your standard change window — no noisgate mitigation SLA applies for LOW severity.
2. Upgrade moment to 2.31.0 — The definitive fix. Run npm update moment or pin "moment": ">=2.31.0" in package.json. Under the noisgate remediation SLA for LOW, treat this as backlog hygiene with no hard deadline, but bundle it with your next dependency refresh.
3. Migrate off moment.js entirely — Moment.js is in maintenance mode and the project itself recommends alternatives (date-fns, Luxon, Day.js). If you are still using moment server-side, this CVE is another reason to schedule migration. This is a strategic action, not an emergency.

Run this on any host where your Node.js application is deployed, or in your CI pipeline. Requires node in PATH. Invoke: bash check_moment_cve2026_17495.sh. No elevated privileges needed.

#!/usr/bin/env bash
# check_moment_cve2026_17495.sh
# Checks whether the installed moment.js version is vulnerable to CVE-2026-17495
# (path traversal via non-string locale name, affects 2.29.2 through 2.30.x)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Try to find moment version from node_modules
if [ -f "node_modules/moment/package.json" ]; then
  VERSION=$(node -e "console.log(require('./node_modules/moment/package.json').version)" 2>/dev/null)
elif command -v npm &>/dev/null; then
  VERSION=$(npm ls moment --json 2>/dev/null | node -e "
    const fs = require('fs');
    const data = JSON.parse(fs.readFileSync('/dev/stdin','utf8'));
    const deps = data.dependencies || {};
    if (deps.moment) { console.log(deps.moment.version); }
    else { process.exit(1); }
  " 2>/dev/null) || true
fi

if [ -z "${VERSION:-}" ]; then
  echo "UNKNOWN - moment.js not found in this project"
  exit 2
fi

echo "Detected moment.js version: $VERSION"

# Parse semver components
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)

# Vulnerable range: >= 2.29.2 and < 2.31.0
if [ "$MAJOR" -eq 2 ]; then
  if [ "$MINOR" -eq 29 ] && [ "$PATCH" -ge 2 ]; then
    echo "VULNERABLE - version $VERSION is in affected range (2.29.2 - 2.30.x)"
    exit 1
  elif [ "$MINOR" -eq 30 ]; then
    echo "VULNERABLE - version $VERSION is in affected range (2.29.2 - 2.30.x)"
    exit 1
  elif [ "$MINOR" -ge 31 ]; then
    echo "PATCHED - version $VERSION is >= 2.31.0"
    exit 0
  else
    echo "PATCHED - version $VERSION is below 2.29.2 (not affected by this CVE; check CVE-2022-24785 instead)"
    exit 0
  fi
else
  echo "UNKNOWN - unexpected major version $MAJOR"
  exit 2
fi

Sources

1. GHSA-4p3w-j4w9-5jqw — moment.js Non-String Locale Path Traversal
2. CVE-2022-24785 — Original moment.js Path Traversal (predecessor)
3. CWE-27: Path Traversal 'dir/../../filename'
4. moment.js npm package — download statistics
5. Snyk — moment.js vulnerability database
6. Moment.js Project Status — maintenance mode announcement
7. PkgPulse — Why Developers Are Abandoning Moment.js in 2026