moment.js CVE-2026-17495

Exploitation requires a server-side Node.js application using moment 2.29.2-2.30.1 that passes user-controlled input directly to moment.locale() without first validating it is a primitive string type. The critical prerequisite is that the attacker must deliver a non-string JavaScript object with custom match() and toString() method implementations to the locale() call - standard JSON deserialization cannot encode method overrides, so exploitation requires a separate deserialization vulnerability, prototype pollution, or an application-layer code path that constructs JavaScript objects from user-supplied data. Passing a plain user-supplied string (the overwhelmingly common case) is not exploitable even in vulnerable versions. Browser-side moment.js usage is entirely unaffected regardless of version.

The official CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) is reasonable: AC:H reflects that constructing a non-string JavaScript object with divergent match()/toString() behaviors cannot be achieved through standard JSON deserialization alone (JSON cannot encode method overrides), materially limiting the attack surface to applications with additional deserialization or object-construction vectors. The impact is scoped to integrity - arbitrary module loading via require(). No EPSS score was included in the input data, no CISA KEV listing exists, and no POC has been confirmed, indicating this is not actively exploited at time of analysis. Real-world risk is elevated only for server-side Node.js applications that directly pass user-supplied locale values from untrusted sources to moment.locale() without type-checking - a narrower pattern than the library's broad deployment footprint might suggest. The 'Authentication Bypass' tag in the input is misleading; this is a guard-bypass/type-confusion leading to path traversal, not a credential or session mechanism bypass.

An attacker targets a Node.js API that accepts a user-supplied locale parameter and passes it unsanitized to moment.locale(). By supplying a crafted non-string object - delivered via a deserialization endpoint, prototype pollution, or an application code path that constructs objects from user input - with a match() that returns a guard-passing result and a toString() that yields a path like '../../malicious/module', the attacker causes require() to load an attacker-specified module. Depending on the server's filesystem contents and module resolution, this could result in loading attacker-influenced or sensitive files.