---
title: moment.js – Regular Expression Denial Of Service Vulnerability
description: "Impact Area Security       Severity High       Affected Element **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-017**** **(for ServiceNow) **SF-JSL-017**** **(for Salesforce) ## Impact moment.js is vulnerable to regular expression denial of service when user input…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/moment-js-regular-expression-denial-of-service-vulnerability/"
updated: "2025-03-21"
category: Rules
---

# moment.js – Regular Expression Denial Of Service Vulnerability

Impact Area

Security

 

 

 

           Severity

High

 

 

 

           Affected Element

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-017**** **(for ServiceNow)

**SF-JSL-017**** **(for Salesforce)

## Impact

moment.js is vulnerable to regular expression denial of service when user input is passed unchecked into moment.duration() blocking the event loop for a period of time. A regular expression string which takes years to evaluate can be introduced, causing the browser to hang.

## Remediation

Update moment.js to the latest version.

### Time to fix

30 min