[chiliap2]

The article lists https://snyk.io/vuln/npm:moment:20161019 as an example of a vulnerability (although not one that is tracked). Could someone explain how a Javascript vulnerability could cause a DDoS? Even if it does cause Moment to hang, how would that affect the server?

[tmikaeld]

A simple Ajax loop would certainly stress the server when run on a lot of clients.