# Moment-timezone - 0.5.34 vulnerability

**URL:** <https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455>\
**Category:** General\
**Created:** [16 May 2023 08:49 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455 "2023-05-16T08:49:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![adang-ibm](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/adang-ibm/32/67038_2.png) [@adang-ibm](https://discourse.nodered.org/u/adang-ibm)\
**Post date:** [16 May 2023 08:49 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/1 "2023-05-16T08:49:12Z")

</div>

Hi,  
I hope I am at the right place to raise this item.  
I'm running Node-Red V3.0.2 and our vulnerability scan has detected a critical vulnerability for moment-timezone - 0.5.34.  
Is there any plan to upgrade to version moment-timezone - 0.5.35 for Node-Red V3 or maybe with Node-Red V4 ?  
Thanks in advance for your answer.  
Alain.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [16 May 2023 13:30 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/2 "2023-05-16T13:30:58Z")

</div>

Yes, it will be picked up in the next release which is coming soon.

In mitigation, the actual vulnerability only applies if someone creates a custom build of moment-timezone using the 0.5.34 version. We do not do that; we use the published version and do not create our own build. It is a good example of a CVE that causes lots of churn in projects even if our use of the module goes nowhere near the issue. Still, that type of subtlety isn't well catered for in most vulnerability scanners.

---

<div class="post-metadata">

**Author:** ![adang-ibm](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/adang-ibm/32/67038_2.png) [@adang-ibm](https://discourse.nodered.org/u/adang-ibm)\
**Post date:** [16 May 2023 13:49 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/3 "2023-05-16T13:49:02Z")

</div>

Thanks for your quick reply, I greatly appreciate.  
We will wait for the next release.  
Have a good day.  
Alain

---

<div class="post-metadata">

**Author:** ![cameo69](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cameo69/32/66593_2.png) [@cameo69](https://discourse.nodered.org/u/cameo69)\
**Post date:** [30 May 2023 13:47 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/4 "2023-05-30T13:47:11Z")

</div>

Hi Nick, I am looking at node-red-util [here](https://github.com/node-red/node-red/blob/5d698d66d0857e65b08be41b212b7bcafe5f8261/packages/node_modules/%40node-red/util/package.json#LL24C14-L24C14) and see that it says `"moment-timezone": "0.5.34"`.  
Is there a reason for the version to be fixed to 0.5.34 or was this simply forgotten?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [30 May 2023 14:25 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/5 "2023-05-30T14:25:58Z")

</div>

The beta is released from the `dev` branch and has moment-timezone set to the latest `0.5.43` release:

> <https://github.com/node-red/node-red/blob/26a770e4901a57c6023e4644a31ae464969ad25d/packages/node_modules/%40node-red/util/package.json#L24>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [29 July 2023 14:26 UTC](https://discourse.nodered.org/t/moment-timezone-0-5-34-vulnerability/78455/6 "2023-07-29T14:26:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.