lodash
4.18.1 · 1 Apr 2026MIT136.3M / weekRepositoryHomepagenpmAtom feed
Your version
4.17.18
8 Jul 20204.18.1 is the newest release of 4.x.
Security
6 advisories affect 4.17.18; 4.18.0 fixes them
- Highlodash vulnerable to Code Injection via `_.template` imports key namesGHSA-r5fr-rjxr-66jc · 1 Apr 2026Fixed in 4.18.0
- HighCommand Injection in lodashGHSA-35jh-r3h4-6jhm · 6 May 2021Fixed in 4.17.21
- HighPrototype Pollution in lodashGHSA-p6mc-m468-83gw · 15 Jul 2020Fixed in 4.17.19
- Moderatelodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`GHSA-f23m-r3pf-42rh · 1 Apr 2026Fixed in 4.18.0
- ModerateLodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functionsGHSA-xxjr-mmjv-4gpg · 21 Jan 2026Fixed in 4.17.23
1 more
- ModerateRegular Expression Denial of Service (ReDoS) in lodashGHSA-29mw-wpgm-hmr9 · 6 Jan 2022Fixed in 4.17.21
Release note
No note was found for 4.17.18 on GitHub or in the repository's changelog.