CVE-2022-24785

Moment.js is a common software component used to handle dates and times. In affected server applications, an unsafe language setting can act like a wrongly labelled filing instruction that directs the application toward the wrong place in its files.

This matters to you if you run Moment.js in a server-side application, particularly one that accepts a language or locale choice from visitors. It also applies to organisations using Tenable.sc, Active IQ, Fedora, Debian, or RedCheck where their supplier has identified this issue. For Moment.js, it is only a risk when an attacker-controlled locale value reaches the affected locale-switching feature.

An attacker can trigger this remotely when a vulnerable server application passes an untrusted locale setting into Moment.js. There is no recorded public exploit code and it is not listed in CISA's catalog of vulnerabilities known to be exploited, but the predicted likelihood is rising; schedule the updates promptly.

Confirm exposure by reviewing dependency manifests, lockfiles, deployed package inventories, and application code for server-side Moment.js locale changes driven by request parameters, headers, cookies, or profile settings. Moment.js is fixed in 2.29.2; the vendor states the patch can be applied to all affected versions. For packaged products, target Tenable.sc 5.21.0 or later and RedCheck scanning agent 2.8.0 or later; obtain vendor updates for Active IQ, Fedora, and Debian because the findings do not provide their fixed release numbers.

Upgrade Moment.js through the normal dependency process, run application tests around date formatting and language selection, then deploy the rebuilt application. If patching is delayed, restrict locale inputs to a fixed allowlist before calling Moment.js; do not pass raw user input to locale switching. No CISA KEV remediation due date applies because this CVE is not listed. After deployment, review application logs for unusual locale values, path-related errors, and failed requests around locale handling.

CVSS 3.1: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The weakness is CWE-22/CWE-27 path traversal: server-side Moment.js locale loading can be influenced by a user-controlled locale string. No public exploit code is on record, and CISA KEV does not list the CVE. EPSS predicts a 13.9% likelihood (96th percentile) and is rising; this is a prediction, not confirmation of exploitation. Press attention is rising.