What’s Vulnerable › Vulnerabilities

CVE-2019-1010266: Regular Expression Denial of Service (ReDoS) in lodash

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-17 · updated 2026-06-17
• Weakness: CWE-400

Description

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Affected products

• lodash: before 4.17.11 — fixed in 4.17.11
• Npm Lodash: from 4.7.0 before 4.17.11 — fixed in 4.17.11
• Npm Lodash-Amd: from 4.7.0 before 4.17.11 — fixed in 4.17.11
• Npm Lodash-Es: from 4.7.0 before 4.17.11 — fixed in 4.17.11
• Rubygems Lodash-Rails: from 4.7.0 before 4.17.11; 4.11.2, 4.12.0, 4.13.1, 4.14.1, 4.15.0, 4.16.1 (+7) — fixed in 4.17.11

How to fix

Upgrade to a fixed version: lodash 4.17.11; Npm Lodash 4.17.11; Npm Lodash-Amd 4.17.11; Npm Lodash-Es 4.17.11; Rubygems Lodash-Rails 4.17.11. Check the vendor advisory for mitigations.

References

• https://github.com/lodash/lodash/issues/3359
• https://github.com/lodash/lodash/wiki/Changelog
• https://security.netapp.com/advisory/ntap-20190919-0004/
• https://snyk.io/vuln/SNYK-JS-LODASH-73639
• https://github.com/lodash/lodash/issues/3359
• https://github.com/lodash/lodash/wiki/Changelog
• https://security.netapp.com/advisory/ntap-20190919-0004/
• https://snyk.io/vuln/SNYK-JS-LODASH-73639

Get alerted when CVE-2019-1010266 or the next vulnerability affects your stack