Security Advisory catalog CVE-2026-2950 CVE-2026-2950 Published
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
cve-program · CVE-2026-2950 Published lodash Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "lodash",
"product": "lodash",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"status": "affected",
"version": "4.17.23",
"lessThan": "4.18.1"
},
{
"versionType": "semver",
"status": "unaffected",
"version": "4.18.1"
}
],
"packageURL": "pkg:npm/lodash"
} lodash-es Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "lodash",
"product": "lodash-es",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"status": "affected",
"version": "4.17.23",
"lessThan": "4.18.1"
},
{
"versionType": "semver",
"status": "unaffected",
"version": "4.18.1"
}
],
"packageURL": "pkg:npm/lodash-es"
} lodash-amd Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "lodash",
"product": "lodash-amd",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"status": "affected",
"version": "4.17.23",
"lessThan": "4.18.1"
},
{
"versionType": "semver",
"status": "unaffected",
"version": "4.18.1"
}
],
"packageURL": "pkg:npm/lodash-amd"
} lodash.unset Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "lodash",
"product": "lodash.unset",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"status": "affected",
"version": "0",
"lessThan": "4.18.0"
},
{
"versionType": "semver",
"status": "unaffected",
"version": "4.18.0"
}
],
"packageURL": "pkg:npm/lodash.unset"
} lodash.omit Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "lodash",
"product": "lodash.omit",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"status": "affected",
"version": "0",
"lessThan": "4.18.0"
},
{
"versionType": "semver",
"status": "unaffected",
"version": "4.18.0"
}
],
"packageURL": "pkg:npm/lodash.omit"
} Original source record · Cite this exact observation · Complete original publisher JSON
euvd · EUVD-2026-17591 Published EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields datePublished: Mar 31, 2026, 7:18:35 PM
dateUpdated: Oct 15, 2026, 6:44:37 AM
8 related source bulletins · separate from aliases RHSA-2026:7378: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
CVE-2025-55130 · CVE-2025-55131 · CVE-2025-55132 · CVE-2025-59464 · CVE-2026-2950 · CVE-2026-6734 · CVE-2026-9675 · CVE-2026-9678 · CVE-2026-9697 · CVE-2026-45149 · CVE-2026-48615 · CVE-2026-48618 · CVE-2026-48619 · CVE-2026-48928 · CVE-2026-48930 · CVE-2026-48933 · CVE-2026-48934 · CVE-2026-48935 · CVE-2026-48936 · CVE-2026-59868 · CVE-2026-59870
RHSA-2026:7655: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
CVE-2026-2950 · CVE-2026-45149 · CVE-2026-45736 · CVE-2026-59868 · CVE-2026-59870
RHSA-2026:24841: Red Hat Security Advisory: Red Hat Developer Hub 1.10.0 release.
CVE-2026-2950 · CVE-2026-4923 · CVE-2026-22036 · CVE-2026-27601 · CVE-2026-31988 · CVE-2026-32235 · CVE-2026-33349
WID-SEC-W-2026-1328: Red Hat Hardened Images RPMs: Mehrere Schwachstellen
CVE-2026-2625 · CVE-2026-2950 · CVE-2026-33813 · CVE-2026-42371
RHSA-2026:9455: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
CVE-2026-2950 · CVE-2026-8723 · CVE-2026-45149 · CVE-2026-48615 · CVE-2026-48618 · CVE-2026-48619 · CVE-2026-48928 · CVE-2026-48930 · CVE-2026-48933 · CVE-2026-48934 · CVE-2026-48935 · CVE-2026-48936 · CVE-2026-59868 · CVE-2026-59870
RHBA-2026:21388: Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update
CVE-2026-2950 · CVE-2026-4631 · CVE-2026-4800
RHBA-2026:21387: Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update
CVE-2026-2950 · CVE-2026-4631 · CVE-2026-4800
WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen
CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
nvd · CVE-2026-2950 Published NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Modified
Weakness classifications: CWE-1321
Original publisher date fields published: 2026-03-31T20:16:26.207
lastModified: 2026-10-15T07:18:00.143
4 source CPE criteria · context only cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:* The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
osv · GHSA-f23m-r3pf-42rh Published lodash npm
SEMVER · introduced 4.17.23 → fixed 4.18.1
1 explicitly affected versions 4.17.23
lodash-es npm
SEMVER · introduced 4.17.23 → fixed 4.18.1
1 explicitly affected versions 4.17.23
lodash-amd npm
SEMVER · introduced 4.17.23 → fixed 4.18.1
1 explicitly affected versions 4.17.23
lodash.unset npm
SEMVER · introduced 0 → fixed 4.18.0
lodash.omit npm
SEMVER · introduced 0 → fixed 4.18.0
Original source record · Cite this exact observation · Complete original publisher JSON