lodash
4.18.1 · 1 Apr 2026MIT136.3M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 4.18.1 | Safe from 4.18.0 | |
| 3.10.1 | 66 open advisories, worst critical · last release Aug 2015, no longer updated |
- CriticalPrototype Pollution in lodashGHSA-jf85-cpcp-j695 · 10 Jul 2019fixed in 4.17.12
- Highlodash vulnerable to Code Injection via `_.template` imports key namesGHSA-r5fr-rjxr-66jc · 1 Apr 2026fixed in 4.18.0
- HighCommand Injection in lodashGHSA-35jh-r3h4-6jhm · 6 May 2021fixed in 4.17.21
- HighPrototype Pollution in lodashGHSA-p6mc-m468-83gw · 15 Jul 2020fixed in 4.17.19
- HighPrototype Pollution in lodashGHSA-4xc9-xhrj-v574 · 7 Feb 2019fixed in 4.17.11
- Moderatelodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`GHSA-f23m-r3pf-42rh · 1 Apr 2026fixed in 4.18.0
- ModerateLodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functionsGHSA-xxjr-mmjv-4gpg · 21 Jan 2026fixed in 4.17.23
- ModerateRegular Expression Denial of Service (ReDoS) in lodashGHSA-29mw-wpgm-hmr9 · 6 Jan 2022fixed in 4.17.21
- ModerateRegular Expression Denial of Service (ReDoS) in lodashGHSA-x5rq-j2xg-h7qm · 19 Jul 2019fixed in 4.17.11
- ModeratePrototype Pollution in lodashGHSA-fvqr-27wr-82fm · 26 Jul 2018fixed in 4.17.5
Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.