AIKIDO-2026-947101

TL;DR

moment's locale loader guards against path traversal by calling match() on the locale name without first requiring that name to be a string. A non-string object whose match() satisfies the guard while its toString() or Symbol.toPrimitive returns a traversal path reaches Node's require('./locale/' + name), loading a module from a path the caller of moment.locale() chooses. Plain string locale names are unaffected because the existing validation rejects path separators in strings, so this reaches only server-side Node applications that pass externally influenced non-string values into moment.locale(), and it leaves CVE-2022-24785 incompletely fixed. The fix requires a canonical lowercase locale string before any dynamic require runs.