VYPR
← All advisories
High severityNVD Advisory· Published Jan 4, 2023· Updated Feb 13, 2025

luxon.js inefficient regular expression complexity vulnerability

CVE-2023-22467

Description

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Luxon's DateTime.fromRFC2822() has quadratic complexity leading to ReDoS; patched in versions 1.38.1, 2.5.2, and 3.2.1.

Luxon, a JavaScript date/time library, contains a Regular Expression Denial of Service (ReDoS) vulnerability in its DateTime.fromRFC2822() method. The parsing regex has quadratic (N^2) complexity on specific crafted inputs, causing a noticeable slowdown for strings longer than 10,000 characters [1]. This issue is similar to CVE-2022-31129 in the Moment library [3].

An attacker can exploit this by supplying untrusted data to fromRFC2822(), such as user-provided date strings. No authentication is required; any application that parses RFC2822 dates from external sources is vulnerable. The attack surface is broad, as Luxon is widely used in Node.js and browser environments [4].

Successful exploitation leads to a denial of service (DoS) condition, where the application becomes unresponsive due to excessive CPU consumption. This can disrupt service availability and potentially lead to resource exhaustion [1].

Patches are available in Luxon versions 1.38.1, 2.5.2, and 3.2.1, which fix the regex to prevent quadratic backtracking [2]. As a workaround, users can limit the length of input strings to fromRFC2822() to mitigate the risk [1].

References
  1. NVD - CVE-2023-22467
  2. fix rfc2822 regex · moment/luxon@5ab3bf6
  3. [bugfix] Fix redos in preprocessRFC2822 regex by doublevkay · Pull Request #6015 · moment/moment
  4. GitHub - moment/luxon: ⏱ A library for working with dates and times in JS

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
luxonnpm
>= 1.0.0, < 1.28.11.28.1
luxonnpm
>= 2.0.0, < 2.5.22.5.2
luxonnpm
>= 3.0.0, < 3.2.13.2.1

Affected products

3
  • Moment.js/momentllm-fuzzy
    Range: <1.38.1, <2.5.2, <3.2.1
  • ghsa-coords
    pkg:npm/luxon
    Range: >= 1.0.0, < 1.28.1
  • moment/luxonv5
    Range: >= 1.0.0, < 1.38.1

Patches

1
5ab3bf64a10d

fix rfc2822 regex

https://github.com/moment/luxonIsaac CambronJan 4, 2023via ghsa
commit
1 file changed · +1 −1
  • src/impl/regexParser.js+1 −1 modified
    @@ -225,7 +225,7 @@ function extractRFC2822(match) {
 function preprocessRFC2822(s) {
   // Remove comments and folding whitespace and replace multiple-spaces with a single space
   return s
-    .replace(/\([^)]*\)|[\n\t]/g, " ")
+    .replace(/\([^()]*\)|[\n\t]/g, " ")
     .replace(/(\s\s+)/g, " ")
     .trim();
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.