- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 1 high, 2 medium
- Weekly downloads
- 8,209
- Dependents
- 16
- Registry
- npm
Advisories 5
- CVE-2026-4800High 8.1
lodash vulnerable to Code Injection via `_.template` imports key names
Affected: from 4.0.0, fixed in 4.18.0.
- CVE-2026-2950Medium 6.5
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Affected: fixed in 4.18.0.
- CVE-2025-13465Medium 6.9
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Affected: from 4.0.0, fixed in 4.17.23.
- CVE-2019-10744Unrated
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.
Affected: fixed in 4.17.13.
- CVE-2019-1010266Unrated
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.
Affected: from 4.7.0, fixed in 4.17.11.