From 019806b26f544e42c42bcaafba0bfd3c9066c7db Mon Sep 17 00:00:00 2001
From: Matt Johnson-Pint <mattjohnsonpint@gmail.com>
Date: Sun, 26 Jul 2026 18:06:57 -0700
Subject: [PATCH] [bugfix] prevent object prototypes in format strings (#6376)

---
 src/lib/format/format.js  |  9 ++++++---
 src/test/moment/format.js | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/lib/format/format.js b/src/lib/format/format.js
index 7abe2609d..947470b45 100644
--- a/src/lib/format/format.js
+++ b/src/lib/format/format.js
@@ -1,5 +1,6 @@
 import zeroFill from '../utils/zero-fill';
 import isFunction from '../utils/is-function';
+import hasOwnProp from '../utils/has-own-prop';
 
 var formattingTokens =
         /(\[[^\[]*\])|(\\)?([Hh]mm(ss)?|Mo|MM?M?M?|Do|DDDo|DD?D?D?|ddd?d?|do?|w[o|w]?|W[o|W]?|Qo?|N{1,5}|YYYYYY|YYYYY|YYYY|YY|y{2,4}|yo?|gg(ggg?)?|GG(GGG?)?|e|E|a|A|hh?|HH?|kk?|mm?|ss?|S{1,9}|x|X|zz?|ZZ?|.)/g,
@@ -77,10 +78,12 @@ export function formatMoment(m, format) {
     }
 
     format = expandFormat(format, m.localeData());
-    formatFunctions[format] =
-        formatFunctions[format] || makeFormatFunction(format);
+    var cacheKey = '$' + format;
+    if (!hasOwnProp(formatFunctions, cacheKey)) {
+        formatFunctions[cacheKey] = makeFormatFunction(format);
+    }
 
-    return formatFunctions[format](m);
+    return formatFunctions[cacheKey](m);
 }
 
 export function expandFormat(format, locale) {
diff --git a/src/test/moment/format.js b/src/test/moment/format.js
index 7fbcafc01..559650da3 100644
--- a/src/test/moment/format.js
+++ b/src/test/moment/format.js
@@ -949,3 +949,23 @@ test('does not modify original moment instance', function (assert) {
         'issue #5681 regression'
     );
 });
+
+test('format strings matching Object prototype keys', function (assert) {
+    var m = moment([2025, 2, 16, 12, 34, 56, 789]);
+
+    assert.equal(
+        m.format('constructor'),
+        'con56tructor',
+        'constructor is treated as a format string'
+    );
+    assert.equal(
+        m.format('toString'),
+        'to7tring',
+        'toString is treated as a format string'
+    );
+    assert.equal(
+        m.format('__proto__'),
+        '__proto__',
+        '__proto__ is treated as a format string'
+    );
+});
-- 
2.47.3