npm package report

Is luxon safe?

1 known vulnerability, worst severity HIGH.

// reach

0 direct dependencies

none carry a known advisory

    100 packages depend on it

    an advisory here reaches each of them

    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai model usage

    Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

    cvss
    7.5
    high

    CVSS v3.1 base score out of 10

    epss
    1.9%
    medium

    chance of exploitation in 30 days, 79th percentile of all CVEs

    xyz score
    4.6
    medium

    CyberXYZ composite out of 10

    fig. 01 — GHSA-3xq5-wjfh-ppjc, the advisory selected below

    // 1 advisories

    GHSA-3xq5-wjfh-ppjc

    HIGHGitHub ratingCVE-2023-22467
    // impact

    Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

    This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g

    // workarounds

    Limit the length of the input.

    // references

    There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

    // details

    DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.

    // cvss v3.1 vector

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Attack vector
    Network
    Attack complexity
    Low
    Privileges required
    None
    User interaction
    None
    Scope
    Unchanged
    Confidentiality
    None
    Integrity
    None
    Availability
    High

    Checked 2026-11-07 at 17:44 UTC. The most recent advisory here was published 2023-01-09. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.