CVE-2026-17495: moment vulnerable to Path Traversal via crafted non-string locale name
moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.
This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.
References
- cna.openjsf.org/security-advisories.html
- github.com/advisories/GHSA-4p3w-j4w9-5jqw
- github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
- github.com/moment/moment/pull/6386
- github.com/moment/moment/releases/tag/2.31.0
- github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
- nvd.nist.gov/vuln/detail/CVE-2026-17495
Code Behaviors & Features
Detect and mitigate CVE-2026-17495 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →