CVE-2019-10744
Prototype Pollution in lodash
CVE-2019-10744 is a critical vulnerability (CVSS 9.1) in Lodash, published July 10, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.01%, the 92nd percentile. Fixed in lodash 4.17.12.
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10744- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List No score
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10744- Updated
- 2026-11-02
EUVDEUVD-2019-0597 No score
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
EUVD-2019-0597- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jf85-cpcp-j695
Prototype Pollution in lodash
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.12 or later.
- Record
GHSA-jf85-cpcp-j695- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-20, CWE-1321
- Updated
- 2026-11-02
OSVAZL-44634
CVE-2019-10744 affecting package js-jquery 3.5.0-4
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
AZL-44634- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSV
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10744- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Show 17 moreShow less
OSVDEBIAN-CVE-2019-10744
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
DEBIAN-CVE-2019-10744- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-jf85-cpcp-j695
Prototype Pollution in lodash
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.12 or later.
- Record
GHSA-jf85-cpcp-j695- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1321, CWE-20
- Updated
- 2026-11-02
OSVRHSA-2019:3024
Red Hat Security Advisory: ovirt-web-ui security and bug fix update
- Record
RHSA-2019:3024- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2362
Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update
- Record
RHSA-2020:2362- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10744
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
UBUNTU-CVE-2019-10744- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1773188140 No score
TuxCare security update for lodash (5 CVEs)
TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2.
- Record
CLSA-2026-1773188140- Updated
- 2026-11-02
OSVCLSA-2026-1775262599 No score
TuxCare security update for 11 packages (4 CVEs)
TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 3.2.0-tuxcare.1.
- Record
CLSA-2026-1775262599- Updated
- 2026-11-02
OSVCLSA-2026-1775262601 No score
TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1.
- Record
CLSA-2026-1775262601- Updated
- 2026-11-02
OSVCLSA-2026-1775262602 No score
TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1.
- Record
CLSA-2026-1775262602- Updated
- 2026-11-02
OSVCLSA-2026-1776904646 No score
TuxCare security update for 11 packages (4 CVEs)
TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 4.5.0-tuxcare.5.
- Record
CLSA-2026-1776904646- Updated
- 2026-11-02
OSVCLSA-2026-1777336764 No score
TuxCare security update for lodash (6 CVEs)
TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.
- Record
CLSA-2026-1777336764- Updated
- 2026-11-02
OSVCLSA-2026-1784250520 No score
TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1.
- Record
CLSA-2026-1784250520- Updated
- 2026-11-02
OSVCLSA-2026-1784509817 No score
TuxCare security update for lodash (3 CVEs)
TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.5-tuxcare.2.
- Record
CLSA-2026-1784509817- Updated
- 2026-11-02
OSVCLSA-2026-1784509823 No score
TuxCare security update for lodash (3 CVEs)
TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.4-tuxcare.2.
- Record
CLSA-2026-1784509823- Updated
- 2026-11-02
OSVCLSA-2026-1785468076 No score
TuxCare security update for lodash-es (7 CVEs)
TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1.
- Record
CLSA-2026-1785468076- Updated
- 2026-11-02
OSVCLSA-2026-1792869760 No score
TuxCare security update for lodash.isequal (7 CVEs)
TuxCare rebuilt lodash.isequal to address 7 CVEs. Fixed in 4.5.0-tuxcare.9.
- Record
CLSA-2026-1792869760- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2019-10744 No score
CVE-2019-10744 in @rootio/lodash - Patched by Root
Root has patched CVE-2019-10744 in the @rootio/lodash package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2019-10744- Updated
- 2026-11-02
Affected products
- lodash
- snyk lodash
- f5 big-ip access policy manager
- f5 big-ip advanced firewall manager
- f5 big-ip analytics
- f5 big-ip application acceleration manager
- f5 big-ip application security manager
- f5 big-ip application visibility and reporting
- f5 big-ip domain name system
- f5 big-ip edge gateway
- f5 big-ip fraud protection service
- f5 big-ip global traffic manager
Show 10 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lodashnpm |
before 4.17.12 | 4.17.12 |
lodash-esnpm |
before 4.17.14 | 4.17.14 |
lodash-amdnpm |
before 4.17.13 | 4.17.13 |
lodash.defaultsdeepnpm |
before 4.6.1 | 4.6.1 |
lodash-railsRubyGems |
before 4.17.12 | 4.17.12 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
lodashTuxCare:npm |
3.10.1-tuxcare.0 up to 3.10.1-tuxcare.2, plus listed versions 3.10.13.10.1-tuxcare.1 |
3.10.1-tuxcare.2 |
lodashTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash._basematchesTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash._createwrapperTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lodash.endswithTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.escapeTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.isplainobjectTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.parseintTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.startswithTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.unescapeTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.uniqueidTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.wordsTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodashTuxCare:npm |
1.3.1-tuxcare.0 up to 1.3.1-tuxcare.1, plus listed versions 1.3.1 |
1.3.1-tuxcare.1 |
lodashTuxCare:npm |
2.4.2-tuxcare.0 up to 2.4.2-tuxcare.1, plus listed versions 2.4.2 |
2.4.2-tuxcare.1 |
lodashTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.cloneTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.clonedeepTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.clonedeepwithTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.differenceTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.flatmapTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.foreachTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.isequalTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.uniqTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.uniqwithTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.xorTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodashTuxCare:npm |
4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions 4.18.1 |
4.18.1-tuxcare.1 |
lodashTuxCare:npm |
4.17.11-tuxcare.0 up to 4.17.11-tuxcare.1, plus listed versions 4.17.11 |
4.17.11-tuxcare.1 |
lodashTuxCare:npm |
4.17.5-tuxcare.0 up to 4.17.5-tuxcare.2, plus listed versions 4.17.54.17.5-tuxcare.1 |
4.17.5-tuxcare.2 |
lodashTuxCare:npm |
4.17.4-tuxcare.0 up to 4.17.4-tuxcare.2, plus listed versions 4.17.44.17.4-tuxcare.1 |
4.17.4-tuxcare.2 |
lodash-esTuxCare:npm |
4.17.11-tuxcare.0 up to 4.17.11-tuxcare.1, plus listed versions 4.17.11 |
4.17.11-tuxcare.1 |
lodash.isequalTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.9, plus listed versions 4.5.04.5.0-tuxcare.74.5.0-tuxcare.8 |
4.5.0-tuxcare.9 |
node-lodashDebian:12 |
before 4.17.15+dfsg-1 | 4.17.15+dfsg-1 |
node-lodashDebian:13 |
before 4.17.15+dfsg-1 | 4.17.15+dfsg-1 |
node-lodashDebian:14 |
before 4.17.15+dfsg-1 | 4.17.15+dfsg-1 |
lodash-railsRubyGems |
before 4.17.12, plus listed versions 0.10.00.7.00.8.10.8.20.9.0 Show 45 moreShow less0.9.10.9.21.0.0.rc.11.0.0.rc.21.0.0.rc.31.0.11.1.01.1.11.2.01.2.11.3.12.0.02.1.02.2.02.2.12.3.02.4.02.4.13.1.03.10.03.10.13.2.03.3.03.3.13.3.1.13.4.03.5.03.6.03.7.03.9.34.0.04.11.24.12.04.13.14.14.14.15.04.16.14.16.34.16.44.16.64.17.104.17.114.17.24.17.44.17.5 |
4.17.12 |
ovirt-web-uiRed Hat:rhev_manager:4.3 |
before 0:1.6.0-1.el7ev | 0:1.6.0-1.el7ev |
jaegerRed Hat:service_mesh:1.0::el7 |
before 0:v1.13.1.redhat7-1.el7 | 0:v1.13.1.redhat7-1.el7 |
kialiRed Hat:service_mesh:1.0::el7 |
before 0:v1.0.11.redhat1-1.el7 | 0:v1.0.11.redhat1-1.el7 |
servicemesh-grafanaRed Hat:service_mesh:1.0::el8 |
before 0:6.2.2-36.el8 | 0:6.2.2-36.el8 |
servicemesh-grafana-prometheusRed Hat:service_mesh:1.0::el8 |
before 0:6.2.2-36.el8 | 0:6.2.2-36.el8 |
@rootio/lodashRoot:npm |
before 2.4.2-root.io.2 | 2.4.2-root.io.22.4.2-root.io.12.4.2-root.io.30.1.0-root.io.10.1.0-root.io.22.4.2-root.io.40.1.0-root.io.3 |
lodashRoot:npm |
before 0.1.0-aikido.2 | 0.1.0-aikido.22.4.2-aikido.40.1.0-aikido.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | jimahub/scenario-b-warn | 2026-09-28 |
| PoC in GitHub | mlbrilliance/aurora-demo-lockfile | 2026-05-11 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
access.redhat.com/errata/RHSA-2019:3024
oracle.com/security-alerts/cpuoct2020.html
snyk.io/vuln/SNYK-JS-LODASH-450202
security.netapp.com/advisory/ntap-20191004-0005
support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
Show 39 moreShow less
github.com/lodash/lodash/pull/4336
nvd.nist.gov/vuln/detail/CVE-2019-10744
security-tracker.debian.org/tracker/CVE-2019-10744
bugzilla.redhat.com/show_bug.cgi?id=1686454
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3024.json
cve.org/CVERecord?id=CVE-2019-8331
blog.jquery.com/2019/04/10/jquery-3-4-0-released
drupal.org/sa-core-2019-006
ubuntu.com/security/CVE-2019-10744
Left out here: 3 versions. The JSON record has them.