npm/lodash-es CVE-2026-2950: medium 6.5, EPSS 0.34%
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt
Action: Upgrade lodash-es to 4.18.1 or later.
npm i lodash-es@4.18.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.17.23 | 4.18.1 | - |
Fixed versions
| 4.18.1 |
Sources
- osv: GHSA-f23m-r3pf-42rh#npm/lodash-es
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- https://nvd.nist.gov/vuln/detail/CVE-2026-2950
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e
- https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8
- https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4
- https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d
- https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b
- https://cna.openjsf.org/security-advisories.html
- https://github.com/lodash/lodash/releases/tag/4.18.1
CVE-2026-2950 · published · modified · JSON