Skip to content
Noroxi

Lodash vulnerabilitiesLodash: known vulnerabilities and safe versions

npm: lodash

Lodash has 10 known vulnerability records: 10 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses).

By branch: 4.x is safe from 4.18.0; 3.x has no fixed release in the records.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
4.x——10critical4.18.0
3.x——8criticalNo fix

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2026-4800exploit code exists2026-03-31

    lodash vulnerable to Code Injection via `_.template` imports key names

    Affected versions: >= 4.0.0, < 4.18.0 · < 4.17.21

    critical 9.8

    Fixed in: 4.17.21, 4.18.0

    EPSS 2.6%

  • CVE-2026-29502026-03-31

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    Affected versions: < 4.18.0 · >= 4.0.0, < 4.17.23

    medium 5.3

    Fixed in: 4.17.23, 4.18.0

  • CVE-2025-13465exploit code exists2026-01-21

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    Affected versions: >= 4.0.0, < 4.17.23 · < 4.18.0

    medium 6.9

    Fixed in: 4.17.23, 4.18.0

    EPSS 1.8%

  • CVE-2021-23337exploit code exists2021-02-15

    Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

    Affected versions: < 4.17.21 · >= 4.0.0, < 4.18.0

    high 7.2

    Fixed in: 4.17.21, 4.18.0

    EPSS 21.3%

  • CVE-2020-285002021-02-15

    Regular Expression Denial of Service (ReDoS)

    Affected versions: >= 4.0.0, < 4.17.21

    medium 5.3

    Fixed in: 4.17.21

    EPSS 7.3%

  • CVE-2020-82032020-07-15

    Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

    Affected versions: >= 3.7.0, < 4.17.19

    high 7.4

    Fixed in: 4.17.19

    EPSS 5.2%

  • CVE-2019-10744exploit code exists2019-07-25

    Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.

    Affected versions: < 4.17.12

    critical 9.1

    Fixed in: 4.17.12

    EPSS 5%

  • CVE-2019-10102662019-07-17

    lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.

    Affected versions: >= 4.7.0, < 4.17.11

    medium 6.5

    Fixed in: 4.17.11

    EPSS 3%

  • CVE-2018-164872019-02-01

    A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into

    Affected versions: < 4.17.11

    medium 5.6

    Fixed in: 4.17.11

    EPSS 1.4%

  • CVE-2018-37212018-06-06

    lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer

    Affected versions: < 4.17.5

    medium 6.5

    Fixed in: 4.17.5

    EPSS 2.3%

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 19, 2026.

Other libraries