lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Priority LOW 35CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Partial Red Hat: 6 fixed, 56 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Partial lodash (lodash): 4.18.1lodash-es (lodash): 4.18.1+8 more productsRed Hat: 4 advisoriesRed Hat: 6 fixed, 56 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lodash | lodash | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | CNA |
| lodash | lodash-es | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | CNA |
| lodash | lodash-amd | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | CNA |
| lodash | lodash.unset | before 4.18.0 | 4.18.0 | Patch available | CNA |
| lodash | lodash.omit | before 4.18.0 | 4.18.0 | Patch available | CNA |
| — | lodash (npm) | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | GHSA-f23m-r3pf-42rh |
| — | lodash-es (npm) | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | GHSA-f23m-r3pf-42rh |
| — | lodash-amd (npm) | 4.17.23 to before 4.18.1 | 4.18.1 | Patch available | GHSA-f23m-r3pf-42rh |
| — | lodash.unset (npm) | before 4.18.0 | 4.18.0 | Patch available | GHSA-f23m-r3pf-42rh |
| — | lodash.omit (npm) | before 4.18.0 | 4.18.0 | Patch available | GHSA-f23m-r3pf-42rh |
- lodash Vendorlodash Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
- lodash-es Vendorlodash Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
- lodash-amd Vendorlodash Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
- lodash.unset Vendorlodash Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
- lodash.omit Vendorlodash Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
- lodash (npm) Vendor— Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available GHSA-f23m-r3pf-42rh
- lodash-es (npm) Vendor— Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available GHSA-f23m-r3pf-42rh
- lodash-amd (npm) Vendor— Affected 4.17.23 to before 4.18.1 Fixed in 4.18.1 Patch available GHSA-f23m-r3pf-42rh
- lodash.unset (npm) Vendor— Affected before 4.18.0 Fixed in 4.18.0 Patch available GHSA-f23m-r3pf-42rh
- lodash.omit (npm) Vendor— Affected before 4.18.0 Fixed in 4.18.0 Patch available GHSA-f23m-r3pf-42rh
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* | 4.0.0 to before 4.17.23 | Vulnerable | lodash |
| cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* | 4.0.0 to before 4.17.23 | Vulnerable | lodash |
| cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* | 4.0.0 to before 4.17.23 | Vulnerable | lodash |
| cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:* | 4.0.0 | Vulnerable | lodash |
- cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.17.23 Vulnerable ·lodash
- cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.17.23 Vulnerable ·lodash
- cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.17.23 Vulnerable ·lodash
- cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:* Versions 4.0.0 Vulnerable ·lodash
Remediation
- Fix · CNA lodash (lodash) Fixed in 4.18.1
- Fix · CNA lodash-es (lodash) Fixed in 4.18.1
- Fix · CNA lodash-amd (lodash) Fixed in 4.18.1
- Fix · CNA lodash.unset (lodash) Fixed in 4.18.0
- Fix · CNA lodash.omit (lodash) Fixed in 4.18.0
- Fix · GHSA-f23m-r3pf-42rh lodash (npm) Fixed in 4.18.1 Advisory →
- Fix · GHSA-f23m-r3pf-42rh lodash-es (npm) Fixed in 4.18.1 Advisory →
- Fix · GHSA-f23m-r3pf-42rh lodash-amd (npm) Fixed in 4.18.1 Advisory →
- Fix · GHSA-f23m-r3pf-42rh lodash.unset (npm) Fixed in 4.18.0 Advisory →
- Fix · GHSA-f23m-r3pf-42rh lodash.omit (npm) Fixed in 4.18.0 Advisory →
Red Hat 4 advisories
- RHSA-2026:24841 Released 2026-06-09 · Red Hat rating ModerateRed Hat Developer Hub 1.10.0 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2026:9455 Released 2026-04-21 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs20-20.20.2-1.hum1@aarch64, nodejs20-20.20.2-1.hum1@src, nodejs20-20.20.2-1.hum1@x86_64 +14
- RHSA-2026:7655 Released 2026-04-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images yarnpkg-1.22.22-18.1.hum1@aarch64, yarnpkg-1.22.22-18.1.hum1@src, yarnpkg-1.22.22-18.1.hum1@x86_64
Show 1 more Red Hat advisories
- RHSA-2026:7378 Released 2026-04-10 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs25-25.9.0-1.1.hum1@aarch64, nodejs25-25.9.0-1.1.hum1@src, nodejs25-25.9.0-1.1.hum1@x86_64 +14
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
lodash, lodash-amd, lodash-es 4.18.1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-04185 lodash vulnerable to Code Injection via `_.template` imports key namesPriority MEDIUM 48
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:24841 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | — |
| Red Hat Hardened Images | Fixed | RHSA-2026:7378, RHSA-2026:7655, RHSA-2026:9455 |
Not affected: 2 products
- Red Hat Developer Hub 1.10
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2950
- 2026-10-03 Alias added: GHSA-f23m-r3pf-42rh
- 2026-10-15 Fix available: lodash/[email protected], lodash/[email protected], lodash/[email protected] +1 · CNA
- 2026-10-15 2 new references · CNA
- 2026-10-16 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 10) +1 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-03 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] +1 · GHSA-f23m-r3pf-42rh
- 2026-11-03 7 new references · GHSA-f23m-r3pf-42rh
References
Other 10
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://cna.openjsf.org/security-advisories.html
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e
- https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8
- https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4
- https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d
- https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/releases/tag/4.18.1
More Lodash vulnerabilities
- TI-2021-06035 Command injection in Lodash CVSS 3.1HIGH 7.2
- TI-2026-04185 lodash vulnerable to Code Injection via `_.template` imports key names CVSS 3.1CRITICAL 9.8
- TI-2019-08009 Prototype pollution in Snyk lodash CVSS 3.1CRITICAL 9.1
- TI-2020-06621 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. CVSS 3.1HIGH 7.4
- TI-2025-12309 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions CVSS 4.0MEDIUM 6.9
- TI-2020-17303 Regular expression denial of service (ReDoS) in Lodash CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-2950 · CVE Program
- CVE-2026-2950 · NVD
- FIRST EPSS
- GHSA-f23m-r3pf-42rh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2950 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences