- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 2 high, 3 medium
- Weekly downloads
- 69.2M
- Dependents
- 97.2K
- Registry
- npm
Advisories 8
- CVE-2026-4800High 8.1
lodash vulnerable to Code Injection via `_.template` imports key names
Affected: from 4.0.0, fixed in 4.18.0.
- CVE-2026-2950Medium 6.5
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Affected: fixed in 4.18.0.
- CVE-2025-13465Medium 6.9
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Affected: from 4.0.0, fixed in 4.17.23.
- CVE-2021-23337High 7.2
Command Injection
Affected: fixed in 4.17.21.
- CVE-2020-28500Medium 5.3
Regular Expression Denial of Service (ReDoS)
Affected: from 4.0.0, fixed in 4.17.21.
- CVE-2020-8203Unrated
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Affected: from 3.7.0, fixed in 4.17.20.
- CVE-2019-10744Unrated
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.
Affected: fixed in 4.17.14.
- CVE-2019-1010266Unrated
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.
Affected: from 4.7.0, fixed in 4.17.11.