CVE-2019-1010266: Regular Expression Denial of Service (ReDoS) in lodash
Summary
CVE-2019-1010266: Regular Expression Denial of Service (ReDoS) in lodash. Affects lodash versions < 4.17.11. Fixed in 4.17.11. How to fix ↓
Also tracked for
- node-lodash · Debian:11
The same CVE-2019-1010266 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lodash package is a utility library for JavaScript that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions prior to 4.7.11 of lodash are affected by a vulnerability known as Regular Expression Denial of Service (ReDoS). This vulnerability occurs in the Date handler component of lodash. When an attacker provides very long strings, the library attempts to match them using a regular expression, leading to uncontrolled resource consumption and potential denial of service.
Vulnerability Detail
The vulnerability in lodash allows an attacker to cause a denial of service by providing excessively long strings that trigger a regular expression matching process. This can lead to high CPU usage and resource exhaustion, rendering the affected application or system unresponsive. The impact of this vulnerability is a disruption of service availability. The attack vector involves sending specially crafted input to the application that utilizes the vulnerable lodash package.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.11
This is the first release that contains the fix.
npm install lodash@4.17.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to validate and sanitize user input to prevent the possibility of malicious inputs triggering the vulnerability. Additionally, monitoring and limiting the resources consumed by regular expression matching operations can help mitigate the impact of potential denial of service attacks.
Conclusion
The vulnerability in lodash prior to version 4.7.11 can be exploited by an attacker to cause a denial of service by providing excessively long strings. To mitigate this vulnerability, it is crucial to update the lodash package to version 4.7.11 or later. Regularly monitoring and updating dependencies is essential to ensure the security of applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for lodash →
FAQ
The impact of this vulnerability is a denial of service, where an attacker can cause the affected application or system to become unresponsive by exploiting the regular expression denial of service issue in lodash.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, the fix for this vulnerability is available in version 4.7.11 of the lodash package. It is recommended to update to this version or later to mitigate the risk of exploitation.
Regular Expression Denial of Service (ReDoS) is a type of vulnerability where an attacker can exploit the way a regular expression is processed to cause excessive CPU usage and resource exhaustion. This can lead to denial of service attacks, impacting the availability of the affected system or application.
There are no specific instances of this vulnerability being exploited mentioned in the provided information. However, it is important to stay updated with security advisories and apply the necessary fixes to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
