Skip to main content
HIGH

CVE-2022-31129

CVSS v3

7.5

HIGH

EPSS Score

5.6 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for moment.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • momentnpmfrom 2.18.0 · fixed in 2.29.4
  • Moment.jsNuGetfrom 2.18.0 · fixed in 2.29.4

Vendor advisories

  • CVE-2022-31129 Red Hat Product Security42 products fixed · 115 known affected

    moment: inefficient parsing algorithm resulting in DoS

    servicemesh-grafana as a component of OpenShift Service Mesh 2.0 · servicemesh-grafana-prometheus as a component of OpenShift Service Mesh 2.0 · servicemesh-grafana.src as a component of OpenShift Service Mesh 2.0

  • RHSA-2023:3623 Red Hat Product Security159 products fixed

    Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security and bug fix update

  • RHSA-2023:1486 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update

  • RHSA-2023:1043 Red Hat Product Security3 products fixed

    Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7

  • RHSA-2023:1049 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update

  • RHSA-2023:1047 Red Hat Product Security3 products fixed

    Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update

21 more advisories

Full record on NVD

Description

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Technical details

Published
2022-07-06

Frequently asked questions

What is CVE-2022-31129?

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Is CVE-2022-31129 actively exploited?

Active exploitation of CVE-2022-31129 has not been confirmed. Its EPSS score was 5.6% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-31129?

CVE-2022-31129 has a CVSS v3 base score of 7.5 (HIGH severity).

Running moment? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database