Description
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Snyk | lodash | All versions prior to 4.17.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-lodash | 4.17.15+dfsg-1 | — |
| Debian 13 | node-lodash | 4.17.15+dfsg-1 | — |
| Debian 12 | node-lodash | 4.17.15+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | jaeger | v1.13.1.redhat7-1.el7 | RHSA-2020:2362 |
| Red Hat Service Mesh 1 | kiali | v1.0.11.redhat1-1.el7 | RHSA-2020:2362 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-36.el8 | RHSA-2020:2362 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.0-1.el7ev | RHSA-2019:3024 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
federiconbaez/cortex9-lodash-defaultsdeep-prototype-pollution-model ★ 0 · Nov 6, 2026
Python model of lodash _.defaultsDeep 4.17.11 vs 4.17.12 (CVE-2019-10744) in a throwaway realm. No JS engine, no gadgets.
-
jimahub/scenario-b-warn ★ 0 · Sep 28, 2026
Thesis scenario test (research only): Scenario B: WARN path - lodash@4.17.4 CVE-2019-10744 (known-vulnerable dependency, low EPSS)
-
mlbrilliance/aurora-demo-lockfile ★ 0 · May 11, 2026
AURORA demo target — deliberately vulnerable lockfiles (CVE-2019-10744, CVE-2018-18074, CVE-2020-26160)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | lodash | < 4.17.12 | 4.17.12 | GHSA-jf85-cpcp-j695 |
| npm | lodash-amd | < 4.17.13 | 4.17.13 | GHSA-jf85-cpcp-j695 |
| npm | lodash-es | < 4.17.14 | 4.17.14 | GHSA-jf85-cpcp-j695 |
| npm | lodash.defaultsdeep | < 4.6.1 | 4.6.1 | GHSA-jf85-cpcp-j695 |
| RubyGems | lodash-rails | < 4.17.12 | 4.17.12 | GHSA-jf85-cpcp-j695 |
Advisories 5
- RHSA-2020:2362 Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2019:3024 Red Hat Security Advisory: ovirt-web-ui security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- WID-SEC-2024-3184 Elasticsearch/Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-0597 SAP Security Patch Day – März 2024 BSI CERT-Bund (WID) · Mar 11, 2024
References
- RHSA-2019:3024 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://security.netapp.com/advisory/ntap-20191004-0005/
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/security-alerts/cpujan2021.html