CVE-2016-4055
moment is vulnerable to regular expression denial of service when user input is passed unchecked into moment.duration() blocking the event loop for a period of time. Upstream patch: https://github.com/moment/moment/pull/2939 External References: https://nodesecurity.io/advisories/55
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-4055?
CVE-2016-4055 is a vulnerability in the Node.js moment module that allows remote attackers to cause a denial of service.
What is the severity of CVE-2016-4055?
The severity of CVE-2016-4055 is high with a severity value of 6.5.
How does CVE-2016-4055 affect software?
CVE-2016-4055 affects the Node.js moment module versions before 2.11.2, Tenable Nessus version up to 8.2.3, and Oracle Primavera Unifier versions between 16.0 and 18.8.4.
How can CVE-2016-4055 be exploited?
CVE-2016-4055 can be exploited by using a regular expression to cause the affected application to hang.
Where can I find more information about CVE-2016-4055?
More information about CVE-2016-4055 can be found at the following references: [CVE website](https://www.cve.org/CVERecord?id=CVE-2016-4055), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-4055), [Node Security Advisories](https://nodesecurity.io/advisories/55), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1304645), [Red Hat Security](https://access.redhat.com/security/cve/CVE-2016-4055)