Skip to content
Fencer Vulns
high 7.5

CVE-2022-31129 json

Inefficient Regular Expression Complexity in moment

published 2022-07-06 4 y ago modified 2026-09-10 1 mo ago also GHSA-wc69-rhjr-hc9g , EUVD-2022-6433

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.6%
EPSS 5.6% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Patch / fix

  • npm moment 2.29.4
  • nuget Moment.js 2.29.4
  • momentjs moment 2.29.4
  • node-moment Debian 14, Debian 13, Debian 12 2.29.4+ds-1

debian advisories DEBIAN-CVE-2022-31129

  • node-moment Ubuntu 18.04 LTS 2.20.1+ds-1ubuntu0.1
  • node-moment Ubuntu 20.04 LTS 2.24.0+ds-2ubuntu0.1
  • node-moment Ubuntu 22.04 LTS 2.29.1+ds-3ubuntu0.2
  • postfixadmin Ubuntu Pro 22.04 LTS 3.3.10-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-31129

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • ceph ceph storage 6.1 2:17.2.6-70.el9cp
  • cephadm ceph storage 6.1 2:17.2.6-70.el9cp

red hat advisories RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045RHSA-2023:3623RHSA-2023:1486RHSA-2022:6393

  • smdba Manager Server Module 4.2 1.7.11-0.150300.3.12.2
  • drools Manager Server Module 4.2 7.17.0-150300.4.9.2
  • rhnlib Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.7-150300.4.12.2
  • cobbler Manager Server Module 4.2 3.1.2-150300.5.19.1
  • mgr-osad Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.9-150300.2.12.2
  • spacecmd Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.21-150300.4.33.2
  • woodstox Manager Server Module 4.2 4.4.2-150300.3.6.2
  • susemanager Manager Server Module 4.2 4.2.40-150300.3.49.1

suse advisories SUSE-SU-2023:0592-1SUSE-SU-2022:3761-1SUSE-SU-2022:3314-1SUSE-SU-2022:3313-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-31129 updated cvss 7.5

moment: inefficient parsing algorithm resulting in DoS

  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/console-ui-rhel8, rhacm2/grc-ui-api-rhel8, rhacm2/search-api-rhel8, +5 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Ceph Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 4 ceph, librbd1, librgw2, rbd-nbd, ceph-mds, ceph-mgr, +27 more
    affected: no fix available “Fix deferred”
  • Red Hat Ceph Storage 5 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mds, +33 more
    affected: no fix available
  • Red Hat Data Grid 8 moment Red Hat Integration Camel K 1 moment
    affected: no fix planned “Will not fix”
  • Red Hat Integration Data Virtualisation Operator moment
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Service Registry moment
    affected: no fix available
show 20 more
  • Red Hat JBoss Data Grid 7 moment Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 ceph, noobaa-core-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Satellite 6 qpid-dispatch, libqpid-dispatch, qpid-dispatch-tools, qpid-dispatch-router
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-prometheus 2.14.0-18.el8.1, openshift-service-mesh/kiali-rhel8 1.24.16-1
    fixed: vendor fix RHSA-2022:5913
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-prometheus 2.23.0-9.el8, openshift-service-mesh/kiali-rhel8 1.36.12-1
    fixed: vendor fix RHSA-2022:5914
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
  • Red Hat Gluster 3.5 Web Administration on RHEL-7 grafana 5.2.4-6.el7rhgs
    fixed: vendor fix RHSA-2023:1486
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt 0.16.2-1.el8ev, cockpit-ovirt-dashboard 0.16.2-1.el8ev
    fixed: vendor fix RHSA-2022:6392
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions 1.3.5-1.el8ev
    fixed: vendor fix RHSA-2022:6393
  • Red Hat RHINT Service Registry 2.3.0 GA
    fixed: vendor fix RHSA-2022:6835
  • Red Hat RHODF 4.11 for RHEL 8 odf4/mcg-core-rhel8 v4.11.0-30
    fixed: vendor fix RHSA-2022:6156
  • Red Hat RHOSSM 2.2 for RHEL 8 openshift-service-mesh/kiali-rhel8 1.48.2-1
    fixed: vendor fix RHSA-2022:5915
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2022:6813
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.11-1.el8, servicemesh-cni 2.0.11-1.el8, servicemesh-mixc 2.0.11-1.el8, servicemesh-mixs 2.0.11-1.el8, servicemesh-proxy 2.0.11-1.el8, servicemesh-istioctl 2.0.11-1.el8, +3 more Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.5-1.el8, servicemesh-cni 2.1.5-1.el8, servicemesh-proxy 2.1.5-1.el8, servicemesh-operator 2.1.5-1.el8, servicemesh-ratelimit 2.1.5-1.el8, servicemesh-proxy-wasm 2.1.5-1.el8, +2 more Red Hat Enterprise Linux 8 cockpit, grafana, cockpit-ws, 389-ds-base, cockpit-pcp, grafana-loki, +26 more Red Hat Enterprise Linux 9 cockpit, grafana, cockpit-ws, rhsm-icons, cockpit-pcp, cockpit-bridge, +8 more Red Hat Gluster 3.5 Web Administration on RHEL-7 ruby 2.4.9-94.el7rhgs, ruby-irb 2.4.9-94.el7rhgs, ruby-libs 2.4.9-94.el7rhgs, rubygem-i18n 1.9.1-1.el7rhgs, rubygem-rack 2.2.4-1.el7rhgs, rubygems 2.6.14.4-94.el7rhgs, +28 more
    +3 more products
    Red Hat JBoss Enterprise Application Platform 7 moment Red Hat JBoss Enterprise Application Platform Expansion Pack moment Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    not affected: vulnerable code not present

9 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

5.55% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/moment/moment/pull/6015#issuecomment-1152961973 referenced PoC, tagged "exploit" by a source, unverified
  • huntr.dev https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm moment
>=2.18.0, <2.29.4
2.29.4
nuget Moment.js
>=2.18.0, <2.29.4
2.29.4

Affected products

  • moment moment

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.