CVE-2016-4055: Momentjs Moment

Medium severity, CVSS 6.5. EPSS: 9.9% chance of exploitation in the next 30 days.

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Affected products

• Momentjs Moment: before 2.11.2 (fixed in 2.11.2)
• Oracle Primavera Unifier: from 16.0, up to and including 18.8.4
• Tenable Nessus: up to and including 8.2.3

Published 2017-01-23. Last modified 2026-06-17.