StackPrism

npm package

lodash vulnerabilities by version

The latest release, 4.18.1 (Apr 1, 2026), has no known vulnerabilities. 36% of last week’s 162.3M downloads went to versions with known vulnerabilities. OSV.dev lists 10 advisories for lodash; the newest was published on Apr 1, 2026.

npm (opens in a new tab) describes it as “Lodash modular utilities.”

Latest release
4.18.1
Apr 1, 2026, no known vulnerabilities
Downloads last week
162.3M
All versions, from npm
Advisories on OSV.dev
10
Newest Apr 1, 2026
Licence
MIT
OpenSSF Scorecard
7.5/10
lodash/lodash (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
4.18.1latestApr 1, 2026No known vulnerabilities101.9M
4.17.21Feb 20, 20213 known vulnerabilities, worst rated critical36.9M
4.17.23Jan 21, 20262 known vulnerabilities, worst rated critical14.1M
4.17.15Jul 19, 20196 known vulnerabilities, worst rated critical1.4M
3.10.1Aug 4, 20156 known vulnerabilities, worst rated critical1.4M
4.17.20Aug 13, 20205 known vulnerabilities, worst rated critical1.1M
4.18.0Mar 31, 2026Deprecated release980.8K
2.4.2Apr 26, 20155 known vulnerabilities, worst rated critical913.3K

Who is still on a vulnerable lodash

36% of last week’s 162.3M lodash downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. lodash doesn’t publish support dates we can check.

LineNewest releaseReleased
44.18.1Apr 1, 2026
33.10.1Aug 4, 2015
22.4.2Apr 26, 2015
11.3.1Sep 4, 2013
0.100.10.0Aug 31, 2013
0.90.9.2Aug 31, 2013

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-4800 on OSV.dev (opens in a new tab)GHSA-r5fr-rjxr-66jc

    lodash vulnerable to Code Injection via `_.template` imports key names

    Affects >= 4.0.0, < 4.18.0. Published Apr 1, 2026.

  2. WarningCVE-2026-2950 on OSV.dev (opens in a new tab)GHSA-f23m-r3pf-42rh

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    Affects < 4.18.0. Published Apr 1, 2026.

  3. WarningCVE-2025-13465 on OSV.dev (opens in a new tab)GHSA-xxjr-mmjv-4gpg

    Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

    Affects >= 4.0.0, < 4.17.23. Published Jan 21, 2026.

  4. WarningCVE-2020-28500 on OSV.dev (opens in a new tab)GHSA-29mw-wpgm-hmr9

    Regular Expression Denial of Service (ReDoS) in lodash

    Affects >= 4.0.0, < 4.17.21. Published Jan 6, 2022.

  5. CriticalCVE-2021-23337 on OSV.dev (opens in a new tab)GHSA-35jh-r3h4-6jhm

    Command Injection in lodash

    Affects < 4.17.21. Published May 6, 2021.

All 10 advisories are on OSV.dev (opens in a new tab).

Which lodash do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for lodash, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.