CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().

• CWE-27

• https://cna.openjsf.org/security-advisories.html
• https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17481IBM Documentation Offline 1.0.0 through 1.4.1 could allow a …9.8
• CVE-2026-17482IBM Documentation Offline 1.0.0 through 1.4.1 could allow a …9.8
• CVE-2026-17483IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a l…3.3
• CVE-2026-17485IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…8.2
• CVE-2026-1749There is an Access Control Vulnerability in some HikCentral …6.8
• CVE-2026-17494IBM Power Systems Firmware FW1120.00, and FW1110.00 through …8.2
• CVE-2026-17496NoteGen before 0.32.0 renders AI chat responses with markdow…8.1
• CVE-2026-17497NoteGen before 0.32.0 grants the Tauri shell plugin shell:al…8.3
• CVE-2026-17499IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to…7.8
• CVE-2026-1750The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for W…8.8
• CVE-2026-17500A vulnerability was detected in ggml-org llama.cpp d006858/e…6.9
• CVE-2026-17501A flaw has been found in ggml-org llama.cpp e15efe0. This vu…6.9