Vulnerability Report: Regular Expression Denial of Service (ReDoS) in moment.js

[camgrimsec]

Issue Summary

Affected Packages:

moment@2.24.0
moment-timezone@0.5.23 (and its dependencies)

Fixed Version: moment@2.29.4

Exploit Maturity: Proof of Concept

Steps to Reproduce

Detailed Paths:

Introduced through:
    ghost@5.81.0 → moment@2.24.0
    Fix: Upgrade to moment@2.29.4

Introduced through:
    ghost@5.81.0 → moment-timezone@0.5.23 → moment@2.24.0
    Fix: Update dependencies, particularly moment to a version above 2.29.4. Try relocking your lockfile or deleting node_modules. If the issue persists, one of your dependencies may be bundling outdated modules.

Introduced through:
    ghost@5.81.0 → knex-migrator@5.2.0 → moment@2.24.0
    Fix: Unfortunately, no remediation path is available.

Ghost Version

Latest

Node.js Version

Latest

How did you install Ghost?

Windows

Database type

MySQL 5.7

Browser & OS version

No response

Relevant log / error output

No response

Code of Conduct

• I agree to be friendly and polite to people in this repository

[allouis]

Please report any security issues as laid out here https://ghost.org/docs/security/ and provide an example of the exploit