Read the docs
TI-2020-17303 Aliases CVE-2020-28500GHSA-29mw-wpgm-hmr9

Regular expression denial of service (ReDoS) in Lodash

Priority MEDIUM 40CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07336 94th percentileScored 2026-11-07
Fix Partial Lodash: 4.17.21lodash (npm): 4.17.21+2 more productsRed Hat: 6 advisoriesRed Hat: 5 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Lodashbefore 4.17.214.17.21Patch availableCNA
—lodash (npm)4.0.0 to before 4.17.214.17.21Patch availableGHSA-29mw-wpgm-hmr9
—lodash-es (npm)4.0.0 to before 4.17.214.17.21Patch availableGHSA-29mw-wpgm-hmr9
—lodash.trimend (npm)4.0.0 – 4.5.1—No fix listedGHSA-29mw-wpgm-hmr9
—lodash.trim (npm)4.0.0 – 4.5.1—No fix listedGHSA-29mw-wpgm-hmr9
—lodash-rails (RubyGems)4.0.0 to before 4.17.214.17.21Patch availableGHSA-29mw-wpgm-hmr9
  • Lodash Vendor— Affected before 4.17.21 Fixed in 4.17.21 Patch available CNA
  • lodash (npm) Vendor— Affected 4.0.0 to before 4.17.21 Fixed in 4.17.21 Patch available GHSA-29mw-wpgm-hmr9
  • lodash-es (npm) Vendor— Affected 4.0.0 to before 4.17.21 Fixed in 4.17.21 Patch available GHSA-29mw-wpgm-hmr9
  • lodash.trimend (npm) Vendor— Affected 4.0.0 – 4.5.1 Fixed in — No fix listed GHSA-29mw-wpgm-hmr9
  • lodash.trim (npm) Vendor— Affected 4.0.0 – 4.5.1 Fixed in — No fix listed GHSA-29mw-wpgm-hmr9
  • lodash-rails (RubyGems) Vendor— Affected 4.0.0 to before 4.17.21 Fixed in 4.17.21 Patch available GHSA-29mw-wpgm-hmr9

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*before 4.17.21Vulnerablelodash
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions before 4.17.21 Vulnerable ·lodash
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*8.0.8.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*8.0.8.3.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*2.5.2.1VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*3.0.0.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.1VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*before 1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*1.0 sp1VulnerableSiemens
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* Versions 2.5.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* Versions 3.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens

Remediation

  • Fix · CNA Lodash Fixed in 4.17.21
  • Fix · GHSA-29mw-wpgm-hmr9 lodash (npm) Fixed in 4.17.21 Advisory →
  • Fix · GHSA-29mw-wpgm-hmr9 lodash-es (npm) Fixed in 4.17.21 Advisory →
  • Fix · GHSA-29mw-wpgm-hmr9 lodash-rails (RubyGems) Fixed in 4.17.21 Advisory →

Red Hat 6 advisories

  • RHSA-2022:6429 Released 2022-09-13 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
  • RHSA-2021:3459 Released 2021-09-08 · Red Hat rating Moderate
    Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt-0.15.1-2.el8ev, cockpit-ovirt-dashboard-0.15.1-2.el8ev
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Show 3 more Red Hat advisories
  • RHSA-2021:2543 Released 2021-06-24 · Red Hat rating Moderate
    Red Hat OpenShift Jaeger 1.20.4 security update
    • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5
  • RHSA-2021:2179 Released 2021-06-01 · Red Hat rating Moderate
    RHV Manager security update (ovirt-engine) [ovirt-4.4.6]
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions-1.2.6-1.el8ev, ovirt-web-ui-1.6.9-1.el8ev
  • RHSA-2021:1168 Released 2021-04-13 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.2.2 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix planned: Will not fix
8Base-RHMTC-1.7Fixed RHSA-2022:6429
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2021:2179
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Red Hat OpenShift Jaeger 1.20Fixed RHSA-2021:2543
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2021:3459
Not affected: 11 products
  • 8Base-RHMTC-1.7
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Decision Manager 7
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Jaeger 1.20
  • Red Hat Process Automation 7
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28500
  2. 2026-10-03 Alias added: GHSA-29mw-wpgm-hmr9
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: LOW → MEDIUM

References

Patch 5

Advisory 3

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences