Description
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lodash | lodash | 4.17.23 – < 4.18.1 | 4.18.1 |
| lodash | lodash-es | 4.17.23 – < 4.18.1 | 4.18.1 |
| lodash | lodash-amd | 4.17.23 – < 4.18.1 | 4.18.1 |
| lodash | lodash.unset | < 4.18.0 | 4.18.0 |
| lodash | lodash.omit | < 4.18.0 | 4.18.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-lodash | 4.18.1+dfsg-1 | — |
| Debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 | — |
| Debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-lodash | No fix yet | — |
| Ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | USN-8411-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-lodash | 4.17.23+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 24.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | USN-8411-1 |
| Ubuntu Pro 22.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 20.04 LTS | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 18.04 LTS | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 16.04 LTS | node-lodash | 2.4.1+dfsg-3ubuntu0.1~esm1 | USN-8411-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cockpit +7 | 356.1-1.el10_2 | RHBA-2026:21388 |
| RHEL 9 | cockpit +7 | 356.1-1.el9_8 | RHBA-2026:21387 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs20 +6 | 20.20.2-1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs20-npm | 10.8.2-1.20.20.2.1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs25 +6 | 25.9.0-1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | nodejs25-npm | 11.12.1-1.25.9.0.1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | yarnpkg | 1.22.22-18.1.hum1 | RHSA-2026:7655 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-machines | 355-1.el10 | RLSA-2026:97238 |
| Rocky Linux 10 | cockpit-podman | 129-1.el10 | RLSA-2026:97193 |
| Rocky Linux 10 | rhsm-icons +1 | 17-1.el10.rocky.0.1 | RLSA-2026:97090 |
| Rocky Linux 9 | cockpit-machines | 355-1.el9 | RLSA-2026:97539 |
| Rocky Linux 9 | cockpit-podman | 129-1.el9 | RLSA-2026:97537 |
| Rocky Linux 9 | rhsm-icons +1 | 17-1.el9.rocky.0.1 | RLSA-2026:97514 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.4-r0 | — |
| Wolfi rolling | code-server | 4.112.0-r2 | — |
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r19 | — |
| Wolfi rolling | json-server | 0.17.4-r6 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r18 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.16.0-r11 | — |
| Wolfi rolling | langfuse-3 +1 | 3.164.0-r1 | — |
| Wolfi rolling | npm | 11.12.1-r3 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.5.0-r12 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-observability +3 | 3.5.0-r15 | — |
| Wolfi rolling | prism | 5.15.6-r2 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | renovate | 43.104.7-r0 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r17 | — |
| Wolfi rolling | ts-patch | 4.0.1-r3 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r12 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | lodash | >= 4.17.23, < 4.18.1 | 4.18.1 | GHSA-f23m-r3pf-42rh |
| npm | lodash-amd | >= 4.17.23, < 4.18.1 | 4.18.1 | GHSA-f23m-r3pf-42rh |
| npm | lodash-es | >= 4.17.23, < 4.18.1 | 4.18.1 | GHSA-f23m-r3pf-42rh |
| npm | lodash.omit | < 4.18.0 | 4.18.0 | GHSA-f23m-r3pf-42rh |
| npm | lodash.unset | < 4.18.0 | 4.18.0 | GHSA-f23m-r3pf-42rh |
Advisories 16
- RLSA-2026:97514 Important: subscription-manager-cockpit security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97238 Important: cockpit-machines security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97537 Important: cockpit-podman security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97090 Important: subscription-manager-cockpit security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97193 Important: cockpit-podman security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97539 Important: cockpit-machines security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1328 Red Hat Hardened Images RPMs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- USN-8411-1 node-lodash vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:7655 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7378 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9455 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHBA-2026:21388 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026