CVE-2016-4055: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a de...

Security readout for executives and security teams

CVE-2016-4055 is a denial-of-service issue in the Node.js moment package before 2.11.2. If an application feeds very long untrusted strings into moment.duration, CPU usage can spike and degrade service availability. Exposure is most likely in Node.js applications or bundled products using moment versions earlier than 2.11.2 and parsing duration values from user-controlled input. Presence in third-party advisories does not prove local exposure without dependency evidence. Treat this as a targeted availability risk, not confirmed compromise. Prioritize remediation where vulnerable moment versions run in internet-facing or high-volume services that parse user input. Mitigation focus: Upgrade moment to version 2.11.2 or later.; Check vendor guidance for downstream products that bundle moment.; Avoid passing untrusted raw strings directly into duration parsing..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.