CVE-2018-16487
Prototype Pollution in lodash
CVE-2018-16487 is a medium vulnerability (CVSS 5.6) in Hackerone Lodash, published February 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in lodash 4.17.11.
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
CVE-2018-16487- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
CVE-2018-16487- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2019-0225 No score
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
EUVD-2019-0225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4xc9-xhrj-v574 No score
Prototype Pollution in lodash
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.11 or later.
- Record
GHSA-4xc9-xhrj-v574- Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
CVE-2018-16487- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16487
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
DEBIAN-CVE-2018-16487- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2018-16487
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
- Record
UBUNTU-CVE-2018-16487- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1773188140 No score
TuxCare security update for lodash (5 CVEs)
TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2.
- Record
CLSA-2026-1773188140- Updated
- 2026-11-02
OSVCLSA-2026-1775262599 No score
TuxCare security update for 11 packages (4 CVEs)
TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 3.2.0-tuxcare.1.
- Record
CLSA-2026-1775262599- Updated
- 2026-11-02
OSVCLSA-2026-1775262601 No score
TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1.
- Record
CLSA-2026-1775262601- Updated
- 2026-11-02
OSVCLSA-2026-1775262602 No score
TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1.
- Record
CLSA-2026-1775262602- Updated
- 2026-11-02
OSVCLSA-2026-1776904646 No score
TuxCare security update for 11 packages (4 CVEs)
TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 4.5.0-tuxcare.5.
- Record
CLSA-2026-1776904646- Updated
- 2026-11-02
OSVCLSA-2026-1777336764 No score
TuxCare security update for lodash (6 CVEs)
TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.
- Record
CLSA-2026-1777336764- Updated
- 2026-11-02
OSVCLSA-2026-1784250515 No score
TuxCare security update for lodash (2 CVEs)
TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1.
- Record
CLSA-2026-1784250515- Updated
- 2026-11-02
OSVCLSA-2026-1784509823 No score
TuxCare security update for lodash (3 CVEs)
TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.4-tuxcare.2.
- Record
CLSA-2026-1784509823- Updated
- 2026-11-02
OSVCLSA-2026-1791290323 No score
TuxCare security update for lodash (3 CVEs)
TuxCare rebuilt lodash to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.
- Record
CLSA-2026-1791290323- Updated
- 2026-11-02
OSVCLSA-2026-1792869760 No score
TuxCare security update for lodash.isequal (7 CVEs)
TuxCare rebuilt lodash.isequal to address 7 CVEs. Fixed in 4.5.0-tuxcare.9.
- Record
CLSA-2026-1792869760- Updated
- 2026-11-02
OSVGHSA-4xc9-xhrj-v574 No score
Prototype Pollution in lodash
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.11 or later.
- Record
GHSA-4xc9-xhrj-v574- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2018-16487 No score
CVE-2018-16487 in @rootio/lodash - Patched by Root
Root has patched CVE-2018-16487 in the @rootio/lodash package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2018-16487- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lodashnpm |
before 4.17.11 | 4.17.11 |
lodash-railsRubyGems |
before 4.17.11 | 4.17.11 |
lodashTuxCare:npm |
3.10.1-tuxcare.0 up to 3.10.1-tuxcare.2, plus listed versions 3.10.13.10.1-tuxcare.1 |
3.10.1-tuxcare.2 |
lodashTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash._basematchesTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash._createwrapperTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.endswithTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.escapeTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.isplainobjectTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.parseintTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lodash.startswithTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.unescapeTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.uniqueidTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodash.wordsTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
lodashTuxCare:npm |
1.3.1-tuxcare.0 up to 1.3.1-tuxcare.1, plus listed versions 1.3.1 |
1.3.1-tuxcare.1 |
lodashTuxCare:npm |
2.4.2-tuxcare.0 up to 2.4.2-tuxcare.1, plus listed versions 2.4.2 |
2.4.2-tuxcare.1 |
lodashTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.cloneTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.clonedeepTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.clonedeepwithTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.differenceTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.flatmapTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.foreachTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.isequalTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.uniqTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.uniqwithTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodash.xorTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.5, plus listed versions 4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.4 |
4.5.0-tuxcare.5 |
lodashTuxCare:npm |
4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions 4.18.1 |
4.18.1-tuxcare.1 |
lodashTuxCare:npm |
4.17.5-tuxcare.0 up to 4.17.5-tuxcare.1, plus listed versions 4.17.5 |
4.17.5-tuxcare.1 |
lodashTuxCare:npm |
4.17.4-tuxcare.0 up to 4.17.4-tuxcare.2, plus listed versions 4.17.44.17.4-tuxcare.1 |
4.17.4-tuxcare.2 |
lodashTuxCare:npm |
2.3.0-tuxcare.0 up to 2.3.0-tuxcare.1, plus listed versions 2.3.0 |
2.3.0-tuxcare.1 |
lodash.isequalTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.9, plus listed versions 4.5.04.5.0-tuxcare.74.5.0-tuxcare.8 |
4.5.0-tuxcare.9 |
node-lodashDebian:12 |
before 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
node-lodashDebian:13 |
before 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
node-lodashDebian:14 |
before 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
lodash-railsRubyGems |
before 4.17.11, plus listed versions 0.10.00.7.00.8.10.8.20.9.0 Show 45 moreShow less0.9.10.9.21.0.0.rc.11.0.0.rc.21.0.0.rc.31.0.11.1.01.1.11.2.01.2.11.3.12.0.02.1.02.2.02.2.12.3.02.4.02.4.13.1.03.10.03.10.13.2.03.3.03.3.13.3.1.13.4.03.5.03.6.03.7.03.9.34.0.04.11.24.12.04.13.14.14.14.15.04.16.14.16.34.16.44.16.64.17.104.17.24.17.44.17.54.3.0 |
4.17.11 |
@rootio/lodashRoot:npm |
before 2.4.2-root.io.2 | 2.4.2-root.io.22.4.2-root.io.32.4.2-root.io.4 |
lodashRoot:npm |
before 2.4.2-aikido.4 | 2.4.2-aikido.4 |
node-lodashUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.1+dfsg-32.4.1+dfsg-3ubuntu0.1~esm1 |
None known |
node-lodashUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.17.4+dfsg-14.17.4+dfsg-1ubuntu0.1~esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
hackerone.com/reports/380873
security.netapp.com/advisory/ntap-20190919-0004
nvd.nist.gov/vuln/detail/CVE-2018-16487
github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
security-tracker.debian.org/tracker/CVE-2018-16487
ubuntu.com/security/CVE-2018-16487
cve.org/CVERecord?id=CVE-2018-16487
Left out here: 2 versions. The JSON record has them.