PatchSiren cyber security CVE debrief

CVE-2016-4055 Momentjs CVE debrief

CVE-2016-4055 is a regular expression denial-of-service issue in Moment.js duration handling before version 2.11.2. According to NVD, attacker-controlled long strings can drive excessive CPU consumption and deny service. The NVD record rates the issue Medium (CVSS 6.5) with network attack, low attack complexity, no user interaction, and high availability impact.

Vendor: Momentjs
Product: Moment
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2017-01-23
Original CVE updated: 2026-05-13
Advisory published: 2017-01-23
Advisory updated: 2026-05-13

Who should care

Teams running Node.js applications that parse untrusted duration input with Moment.js, plus operators of products that NVD maps to this CVE, including Tenable Nessus and Oracle Primavera Unifier.

Technical summary

NVD describes the flaw as a ReDoS in the duration function in moment package versions before 2.11.2. The published CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a remotely reachable denial-of-service condition that primarily affects availability. NVD also lists vulnerable CPE criteria for Moment.js itself and for downstream products Tenable Nessus (through 8.2.3) and Oracle Primavera Unifier (16.0 through 18.8.4).

Defensive priority

Medium, and higher for exposed services that accept user-controlled duration strings or for products explicitly listed as affected by NVD.

Recommended defensive actions

Upgrade Moment.js to 2.11.2 or later wherever it is directly used.
Inventory Node.js services and libraries that rely on Moment.js duration parsing, especially where input is attacker-controlled.
Add input validation, length limits, and request or parse timeouts around duration handling paths.
Monitor for CPU spikes or request slowdowns that could indicate regex backtracking abuse.
Patch or verify vendor guidance for any downstream products NVD maps to this CVE, including Tenable Nessus and Oracle Primavera Unifier, based on the affected versions listed in NVD.

Evidence notes

The supplied NVD metadata states that Moment.js before 2.11.2 is vulnerable to a ReDoS caused by long strings in the duration function. NVD also provides the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-400. The record further lists vulnerable CPE criteria for momentjs:moment, Tenable Nessus through 8.2.3, and Oracle Primavera Unifier 16.0 through 18.8.4. No CISA KEV entry was supplied in the corpus.

Sources and references

Verified primary and authoritative sources

CVE-2016-4055 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2016-4055

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2016-4055 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4055

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E

[email protected]
Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E

[email protected]
Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E

[email protected]
Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.