Description
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Lodash | versions prior to 4.17.21 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1 | — |
| Debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1 | — |
| Debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | USN-8411-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-lodash | 4.17.23+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 24.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | USN-8411-1 |
| Ubuntu Pro 22.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 20.04 LTS | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 18.04 LTS | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 16.04 LTS | node-lodash | 2.4.1+dfsg-3ubuntu0.1~esm1 | USN-8411-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.6-1.el8ev | RHSA-2021:2179 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.9-1.el8ev | RHSA-2021:2179 |
| Red Hat Rhev Hypervisor 4 | cockpit-ovirt +1 | 0.15.1-2.el8ev | RHSA-2021:3459 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | lodash | >= 4.0.0, < 4.17.21 | 4.17.21 | GHSA-29mw-wpgm-hmr9 |
| npm | lodash-es | >= 4.0.0, < 4.17.21 | 4.17.21 | GHSA-29mw-wpgm-hmr9 |
| npm | lodash.trim | >= 4.0.0, <= 4.5.1 | — | GHSA-29mw-wpgm-hmr9 |
| npm | lodash.trimend | >= 4.0.0, <= 4.5.1 | — | GHSA-29mw-wpgm-hmr9 |
| RubyGems | lodash-rails | >= 4.0.0, < 4.17.21 | 4.17.21 | GHSA-29mw-wpgm-hmr9 |
Advisories 9
- USN-8411-1 node-lodash vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2021:3459 Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8] Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2021:2179 Red Hat Security Advisory: RHV Manager security update (ovirt-engine) [ovirt-4.4.6] Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2022-1384 Red Hat Virtualization: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 13, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-3025 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 4, 2023
- WID-SEC-2023-0857 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 4, 2023
- ICSA-22-258-05 Siemens SINEC INS CISA ICS & IT advisories · Sep 13, 2022
- SSA-637483 SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 Siemens ProductCERT · Sep 13, 2022
References
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
- https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
- https://github.com/lodash/lodash/pull/5065
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://security.netapp.com/advisory/ntap-20210312-0006/
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf