CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-26289
High (7.5) in date-and-time project date-and-time. EPSS 2.2% chance of exploitation in the next 30 days. Fixed in date-and-time 0.14.2.
date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
Severity
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- date-and-time_project:date-and-time
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r92x-f52r-x54g | npm | date-and-time | <0.14.2 | 0.14.2 |
References
- https://github.com/knowledgecode/date-and-time/commit/9e4b501eacddccc8b1f559fb414f48472ee17c2a
- https://github.com/knowledgecode/date-and-time/security/advisories/GHSA-r92x-f52r-x54g
- https://www.npmjs.com/package/date-and-time
- https://github.com/knowledgecode/date-and-time/commit/9e4b501eacddccc8b1f559fb414f48472ee17c2a
- https://github.com/knowledgecode/date-and-time/security/advisories/GHSA-r92x-f52r-x54g