CVE-2016-4055GHSA-87VV-R9J6-G5QV
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.11.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- momentnpm
fixed in 2.11.2
References 9
nodesecurity.io
openwall.com
securityfocus.com
tenable.com
lists.apache.org
- thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@<user.flink.apache.org>
- thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@<dev.flink.apache.org>
- thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@<user.flink.apache.org>
- thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@<user.flink.apache.org>