CVE-2026-17495: 
JavaScript vulnerability analysis and mitigation

CVE-2026-17495 is a path traversal vulnerability in the moment.js JavaScript date library affecting versions 2.29.2 through 2.30.1 (exclusive of 2.31.0). It represents an incomplete fix for CVE-2022-24785, allowing a specially crafted non-string object passed to moment.locale() to bypass the locale-name path-traversal guard and reach an internal require() call with attacker-controlled path segments. The vulnerability was published on September 15, 2026, and a patch was made available the same day. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-22 (Path Traversal) and CWE-27 (Path Traversal: 'dir/../../filename'). The moment.locale() function's path-traversal guard was implemented assuming the input is always a string; it calls match() on the input to validate the locale name. An attacker can craft a non-string JavaScript object whose match() method returns a value that satisfies the guard check, while the object's toString() method returns a path-traversal string (e.g., ../../malicious). When this object reaches the internal require() call, Node.js resolves the attacker-controlled path, potentially loading arbitrary files from the server filesystem. This attack vector is network-accessible but requires high complexity and exclusively affects server-side (npm) deployments where user-supplied input is passed directly to moment.locale() (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to manipulate file paths passed to Node.js's require(), potentially loading and executing arbitrary server-side files or modules outside the intended directory. The primary impact is on integrity (rated High in CVSS), with the potential for arbitrary file read or code execution depending on the server's file layout and permissions. Confidentiality and availability are not directly impacted per the CVSS scoring, but chained exploitation could escalate to full server compromise. Only server-side npm users who pass user-controlled input to moment.locale() are at risk; browser-based usage is unaffected (GitHub Advisory, Red Hat).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat). The EPSS score is approximately 0.356%, indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Reconnaissance: Identify server-side Node.js applications using moment.js versions 2.29.2–2.30.1 that accept user-supplied locale input and pass it directly to moment.locale().
2. Craft malicious object: Construct a JavaScript object where the match() method returns a value that passes the locale-name validation regex (e.g., returns null or a benign match result), while toString() returns a path-traversal string such as ../../etc/passwd or a path to a writable/executable location.
3. Deliver payload: Submit the crafted object to the vulnerable application endpoint that invokes moment.locale() with user input — this requires the ability to send non-string data (e.g., via a JSON API that does not enforce string typing on the locale parameter).
4. Trigger path traversal: The malicious object bypasses the guard and is passed to the internal require() call, causing Node.js to attempt to load a module from the attacker-controlled path.
5. Achieve objective: Depending on server configuration and file permissions, the attacker may read sensitive files, cause errors that leak path information, or — if a writable path is reachable — load and execute a previously planted malicious module (GitHub Advisory, Red Hat Bugzilla).

• Logs: Node.js application error logs showing unexpected require() failures or MODULE_NOT_FOUND errors referencing paths containing ../ sequences; access logs showing API requests with locale parameters containing non-standard or encoded path separators.
• File System: Unexpected files or modules appearing in directories accessible to the Node.js process; newly created or modified .js files in application directories that were not deployed intentionally.
• Process: Unusual child processes spawned by the Node.js application process; unexpected outbound network connections from the server following locale-related API calls.
• Network: Repeated API requests to locale-setting endpoints with malformed or non-string locale values, particularly those containing .., %2e, or encoded slash characters (GitHub Advisory).

Upgrade moment.js to version 2.31.0 or later, which contains the complete fix for this vulnerability (GitHub Advisory). As an immediate workaround for environments that cannot upgrade, validate that any user-supplied input is explicitly a string (e.g., typeof input === 'string') before passing it to moment.locale(). Additionally, apply the principle of least privilege to limit the file system paths accessible to the Node.js process, reducing the impact of any successful traversal attempt (Red Hat Bugzilla).

The vulnerability was reported by security researcher zolbooo, with remediation coordinated by UlisesGascon and mattjohnsonpint from the moment.js project, and remediation development by gilmoreorless (GitHub Advisory). Red Hat tracked the issue via Bugzilla with a medium severity rating and engaged a broad set of product teams for impact assessment (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been identified at this time.