npm/lodash.unset CVE-2026-2950: medium 6.5, EPSS 0.33%

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Action: Upgrade lodash.unset to 4.18.0 or later.

npm i lodash.unset@4.18.0

Affected

Fixed versions

Sources

• osv: GHSA-f23m-r3pf-42rh#npm/lodash.unset
• https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
• https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950
• https://github.com/lodash/lodash

CVE-2026-2950 · published 2026-04-01T23:50:27Z · modified 2026-10-17T02:56:13.084362346Z · JSON