CVE-2026-2950: lodash Prototype Pollution via Array Path Bypass in unset and omit Functions
Summary
CVE-2026-2950: lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit. Affects lodash versions < 4.18.0. Fixed in 4.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Lodash is a widely-used JavaScript utility library that provides helpful functions for common programming tasks, such as manipulating arrays, objects, and strings. It is known for its performance and modularity, allowing developers to include only the functions they need. However, certain versions of Lodash are vulnerable to a prototype pollution issue that can lead to security risks.
Vulnerability Detail
Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the _.unset and _.omit functions. The vulnerability arises because the fix for a previous issue (CVE-2025-13465) only protects against string key members. Attackers can exploit this by passing array-wrapped path segments, enabling them to delete properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. While this vulnerability allows for the deletion of prototype properties, it does not permit overwriting their original behavior.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.18.0
This is the first release that contains the fix.
npm install lodash@4.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than upgrading to the patched version.
Conclusion
The vulnerability identified as CVE-2026-2950 in Lodash poses a risk of prototype pollution through specific functions. Users are strongly advised to upgrade to version 4.18.0 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of applications that rely on open-source libraries.
See every vulnerability recorded for lodash →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to unexpected behavior in applications.
Lodash versions 4.17.23 and earlier are affected by this vulnerability.
An attacker could delete properties from built-in prototypes, which may lead to application instability or unexpected behavior.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
