-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moment | npm | >= 2.18.0, < 2.29.4 | 2.29.4 |
| Moment.js | nuget | >= 2.18.0, < 2.29.4 | 2.29.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the preprocessRFC2822 function's regex pattern handling comment removal. The original regex ([^)]) allowed arbitrary characters except ')', enabling nested parentheses exploitation. The commit diff shows the regex was patched to ([^()]) to prevent nesting. This matches the CWE-1333 description of inefficient regex complexity and the advisory's example payload moment('('.repeat(500000)). The function is explicitly called during RFC2822 date parsing, which is tried by default in Moment.js constructors.
A Semantic Attack on Google Gemini - Read the Latest Research