CVE-2026-2950: lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Impact
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
Patches
This issue is patched in 4.18.0.
Workarounds
None. Upgrade to the patched version.
Other sources
Impact:
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for (CVE-2025-13465:
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/lodash.unsetto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodash-amdto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodash-esto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodashto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
debian/node-lodashto a version that resolves this vulnerability.Fixed in 4.18.1+dfsg-3 - Upgrade
Upgrade
lodashto a version that resolves this vulnerability.Fixed in 4.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2950?
CVE-2026-2950 is classified as a high-severity vulnerability due to its potential for prototype pollution.
How do I fix CVE-2026-2950?
To fix CVE-2026-2950, upgrade lodash to version 4.17.24 or later.
Which versions of lodash are affected by CVE-2026-2950?
Lodash versions 4.17.23 and earlier are affected by CVE-2026-2950.
What functions in lodash are vulnerable in CVE-2026-2950?
The vulnerable functions in lodash affected by CVE-2026-2950 are _.unset and _.omit.
What is prototype pollution in the context of CVE-2026-2950?
In the context of CVE-2026-2950, prototype pollution refers to the ability of an attacker to manipulate an object's prototype, potentially leading to application compromise.