Reposted by Matt Johnson-Pint
🚨 Medium-severity security fix in moment@2.31.0 just released!
Patches CVE-2026-17495: moment vulnerable to Path Traversal via crafted non-string locale name
github.com/moment/momen...
github.com
moment vulnerable to Path Traversal via crafted non-string locale name
### Impact
moment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-string, attacker-influenced value to `moment.locale()`, a specially crafted...