Packages / lodash / Security

ModerateVulnerabilityGHSA-x5rq-j2xg-h7qmCVE-2019-1010266SNYK-JS-LODASH-73639Published 19 Jul 2019

Regular Expression Denial of Service (ReDoS) in lodash

Your version

Affected releases · lodash

  • 4.x4.7.0 – 4.17.10Fixed in 4.17.11

On 4.x, the newest line:

npm install lodash@4.17.11
Every release on a timeline

  1. Not affected

    0.1.0 – 4.6.1

    68 releases

  2. Affected

    4.7.0 – 4.17.10

    31 releases

  3. Fixed

    4.17.11 – 4.18.1

    14 releases, latest

113 stable releases of lodash, oldest to newest.

What happens

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.