Every CVE Search/ Get API key

CVE-2026-2950

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

6.5 MediumFix available

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.34%Up 0.3 points since Apr 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
CVE-2026-2950
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1321
Updated
2026-11-02
EUVDEUVD-2026-17591 6.5

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
EUVD-2026-17591
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-f23m-r3pf-42rh 6.5

lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt

Impact

The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches

The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Workarounds

None. Upgrade to the patched version.

References

Record
GHSA-f23m-r3pf-42rh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1321
Updated
2026-11-03
NVD 6.5

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
CVE-2026-2950
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-1321
Updated
2026-11-02
OSV 6.5

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
CVE-2026-2950
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1321
Updated
2026-11-02
OSVDEBIAN-CVE-2026-2950 5.3

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
DEBIAN-CVE-2026-2950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 22 moreShow less
OSVGHSA-f23m-r3pf-42rh 6.5

lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt

Impact

The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches

The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Workarounds

None. Upgrade to the patched version.

References

Record
GHSA-f23m-r3pf-42rh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1321
Updated
2026-11-03
OSVRHBA-2026:21387 9.8

Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Record
RHBA-2026:21387
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2026:21388 9.8

Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Record
RHBA-2026:21388
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:7378 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7378
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:7655 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7655
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9455 7.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:9455
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-2950 6.5

CVE-2026-2950 in lodash - Patched by Root

Root has patched CVE-2026-2950 in the lodash package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-2950
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-2950 6.5

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Record
UBUNTU-CVE-2026-2950
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1777336764 No score

TuxCare security update for lodash (6 CVEs)

TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.

Record
CLSA-2026-1777336764
Updated
2026-11-02
OSVCLSA-2026-1778633139 No score

TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.21-tuxcare.1.

Record
CLSA-2026-1778633139
Updated
2026-11-02
OSVCLSA-2026-1784596286 No score

TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3.

Record
CLSA-2026-1784596286
Updated
2026-11-02
OSVCLSA-2026-1785291645 No score

TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.11-tuxcare.2.

Record
CLSA-2026-1785291645
Updated
2026-11-02
OSVCLSA-2026-1785291646 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.5-tuxcare.3.

Record
CLSA-2026-1785291646
Updated
2026-11-02
OSVCLSA-2026-1785468076 No score

TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1.

Record
CLSA-2026-1785468076
Updated
2026-11-02
OSVCLSA-2026-1785468081 No score

TuxCare security update for lodash-es (3 CVEs)

TuxCare rebuilt lodash-es to address 3 CVEs. Fixed in 4.17.21-tuxcare.1.

Record
CLSA-2026-1785468081
Updated
2026-11-02
OSVCLSA-2026-1785468082 No score

TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1.

Record
CLSA-2026-1785468082
Updated
2026-11-02
OSVCLSA-2026-1791293623 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.23-tuxcare.1.

Record
CLSA-2026-1791293623
Updated
2026-11-02
OSVCLSA-2026-1792102343 No score

TuxCare security update for 10 packages (1 CVE)

TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 4.5.0-tuxcare.8.

Record
CLSA-2026-1792102343
Updated
2026-11-02
OSVCLSA-2026-1792327052 No score

TuxCare security update for lodash.clonedeep (1 CVE)

TuxCare rebuilt lodash.clonedeep to address 1 CVE. Fixed in 4.5.0-tuxcare.8.

Record
CLSA-2026-1792327052
Updated
2026-11-02
OSVCLSA-2026-1792762945 No score

TuxCare security update for lodash (1 CVE)

TuxCare rebuilt lodash to address 1 CVE. Fixed in 4.17.15-tuxcare.11.

Record
CLSA-2026-1792762945
Updated
2026-11-02
OSVCLSA-2026-1792869761 No score

TuxCare security update for lodash.isequal (1 CVE)

TuxCare rebuilt lodash.isequal to address 1 CVE. Fixed in 4.5.0-tuxcare.10.

Record
CLSA-2026-1792869761
Updated
2026-11-02
OSVUSN-8411-1 No score

node-lodash vulnerabilities

It was discovered that Lodash was vulnerable to a prototype pollution issue in the zipObjectDeep function. An attacker could possibly use this issue to modify application behavior. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)

Liyuan Chen discovered that Lodash was vulnerable to a regular expression denial of service issue in the toNumber, trim, and trimEnd functions. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28500)

Marc Hassan discovered that Lodash did not properly sanitize input to the template function. An attacker could possibly use this issue to inject and execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)

It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit functions. An attacker could possibly use this issue to delete properties from global prototypes, resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-13465)

It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit functions. An attacker could possibly use this issue to delete properties from built-in prototypes, resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)

It was discovered that Lodash did not properly validate certain inputs to the template function. An attacker could possibly use this issue to inject malicious code during template processing, resulting in arbitrary code execution. (CVE-2026-4800)

Record
USN-8411-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lodash
npm
 4.17.23 to 4.17.23
4.18.1
lodash-es
npm
 4.17.23 to 4.17.23
4.18.1
lodash-amd
npm
 4.17.23 to 4.17.23
4.18.1
lodash.unset
npm
 before 4.18.0
4.18.0
lodash.omit
npm
 before 4.18.0
4.18.0
lodash
TuxCare:npm
 4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions
4.18.1
4.18.1-tuxcare.1
lodash
TuxCare:npm
 4.17.21-tuxcare.0 up to 4.17.21-tuxcare.1, plus listed versions
4.17.21
4.17.21-tuxcare.1
lodash
TuxCare:npm
 4.17.4-tuxcare.0 up to 4.17.4-tuxcare.3, plus listed versions
4.17.44.17.4-tuxcare.14.17.4-tuxcare.2
4.17.4-tuxcare.3
lodash
TuxCare:npm
 4.17.11-tuxcare.0 up to 4.17.11-tuxcare.2, plus listed versions
4.17.114.17.11-tuxcare.1
4.17.11-tuxcare.2
lodash
TuxCare:npm
 4.17.5-tuxcare.0 up to 4.17.5-tuxcare.3, plus listed versions
4.17.54.17.5-tuxcare.14.17.5-tuxcare.2
4.17.5-tuxcare.3
Show 72 moreShow less
Affected packages
PackageAffectedFixed
lodash-es
TuxCare:npm
 4.17.11-tuxcare.0 up to 4.17.11-tuxcare.1, plus listed versions
4.17.11
4.17.11-tuxcare.1
lodash-es
TuxCare:npm
 4.17.21-tuxcare.0 up to 4.17.21-tuxcare.1, plus listed versions
4.17.21
4.17.21-tuxcare.1
lodash-es
TuxCare:npm
 4.17.15-tuxcare.0 up to 4.17.15-tuxcare.1, plus listed versions
4.17.15
4.17.15-tuxcare.1
lodash
TuxCare:npm
 4.17.23-tuxcare.0 up to 4.17.23-tuxcare.1, plus listed versions
4.17.23
4.17.23-tuxcare.1
lodash
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.clone
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.clonedeepwith
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.difference
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.flatmap
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.foreach
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.isequal
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.uniq
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.uniqwith
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.xor
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.14.5.0-tuxcare.24.5.0-tuxcare.34.5.0-tuxcare.44.5.0-tuxcare.54.5.0-tuxcare.64.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash.clonedeep
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.8, plus listed versions
4.5.04.5.0-tuxcare.7
4.5.0-tuxcare.8
lodash
TuxCare:npm
 4.17.15-tuxcare.0 up to 4.17.15-tuxcare.11, plus listed versions
4.17.154.17.15-tuxcare.14.17.15-tuxcare.104.17.15-tuxcare.24.17.15-tuxcare.3
Show 6 moreShow less
4.17.15-tuxcare.44.17.15-tuxcare.54.17.15-tuxcare.64.17.15-tuxcare.74.17.15-tuxcare.84.17.15-tuxcare.9
4.17.15-tuxcare.11
lodash.isequal
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.10, plus listed versions
4.5.04.5.0-tuxcare.74.5.0-tuxcare.84.5.0-tuxcare.9
4.5.0-tuxcare.10
node-lodash
Debian:12
 before 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
node-lodash
Debian:13
 before 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
node-lodash
Debian:14
 before 4.18.1+dfsg-1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-104.17.21+dfsg+~cs8.31.198.20210220-94.17.23+dfsg-1
4.18.1+dfsg-1
lodash
npm
 4.17.23 up to 4.18.1
4.18.1
lodash-es
npm
 4.17.23 up to 4.18.1
4.18.1
lodash-amd
npm
 4.17.23 up to 4.18.1
4.18.1
cockpit-packagekit
Red Hat:enterprise_linux:9::appstream
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-storaged
Red Hat:enterprise_linux:9::appstream
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-bridge
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-doc
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-system
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-ws
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-ws-selinux
Red Hat:enterprise_linux:9::baseos
 before 0:356.1-1.el9_8
0:356.1-1.el9_8
cockpit-packagekit
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-storaged
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-bridge
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-debugsource
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-doc
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-system
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-ws
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
cockpit-ws-selinux
Red Hat:enterprise_linux:10.2
 before 0:356.1-1.el10_2
0:356.1-1.el10_2
nodejs25
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-bin
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-devel
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-docs
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-libs
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
nodejs25-npm
Red Hat:hummingbird:1
 before 0:11.12.1-1.25.9.0.1.1.hum1
0:11.12.1-1.25.9.0.1.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
 before 0:25.9.0-1.1.hum1
0:25.9.0-1.1.hum1
yarnpkg
Red Hat:hummingbird:1
 before 0:1.22.22-18.1.hum1
0:1.22.22-18.1.hum1
nodejs20
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-bin
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-devel
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-docs
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-full-i18n
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-libs
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
nodejs20-npm
Red Hat:hummingbird:1
 before 0:10.8.2-1.20.20.2.1.hum1
0:10.8.2-1.20.20.2.1.hum1
nodejs20-npm-bin
Red Hat:hummingbird:1
 before 0:20.20.2-1.hum1
0:20.20.2-1.hum1
lodash
Root:npm
 before 4.17.21-aikido.2
4.17.21-aikido.24.17.23-aikido.24.17.21-aikido.3
lodash-es
Root:npm
 before 4.17.23-aikido.2
4.17.23-aikido.24.17.21-aikido.4
@rootio/lodash
Root:npm
 before 4.17.21-root.io.2
4.17.21-root.io.24.17.21-root.io.14.17.23-root.io.14.17.23-root.io.24.17.21-root.io.3
@rootio/lodash-es
Root:npm
 before 4.17.21-root.io.3
4.17.21-root.io.34.17.23-root.io.14.17.23-root.io.24.17.21-root.io.4
node-lodash
Ubuntu:Pro:16.04:LTS
 before 2.4.1+dfsg-3ubuntu0.1~esm1, plus listed versions
2.4.1+dfsg-3
2.4.1+dfsg-3ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:18.04:LTS
 before 4.17.4+dfsg-1ubuntu0.1~esm1, plus listed versions
4.17.4+dfsg-1
4.17.4+dfsg-1ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:20.04:LTS
 before 4.17.15+dfsg-2ubuntu0.1~esm1, plus listed versions
4.17.11+dfsg-44.17.15+dfsg-2
4.17.15+dfsg-2ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:22.04:LTS
 before 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.173-14.17.21+dfsg+~cs8.31.196.20210220-24.17.21+dfsg+~cs8.31.198.20210220-44.17.21+dfsg+~cs8.31.198.20210220-5
4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:24.04:LTS
 before 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1
node-lodash
Ubuntu:25.10
 before 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1
node-lodash
Ubuntu:26.10
 All versions, plus listed versions
4.17.23+dfsg-14.18.1+dfsg-34.18.1+dfsg1-14.18.1+dfsg1-2
 None known
node-lodash
Ubuntu:Pro:26.04:LTS
 before 4.17.23+dfsg-1ubuntu0.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-94.17.23+dfsg-1
4.17.23+dfsg-1ubuntu0.1~esm1

History

History
RecordedChangedSources
factsGitHub Advisories
affected, referencesGitHub Advisories, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2950 is a medium vulnerability (CVSS 6.5) in Lodash, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in lodash 4.18.1.

References

Show 147 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open