# CVE-2018-16487: lodash prototype pollution in merge functions

Source: https://junglewise.ai/threats/cve-2018-16487-lodash-prototype-pollution-in-merge-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-16487 · Severity: info · CVSS 7.5 · Published 2019-02-07

lodash is a widely-used JavaScript library that provides utility functions for common programming tasks. Versions before 4.17.11 contain a prototype pollution vulnerability in the merge and mergeWith functions that allows an attacker to add or modify properties on all JavaScript objects application-wide. This can lead to application logic bypass, data manipulation, or unauthorized behavior depending on how the application uses these properties.

Technologies: [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-rails (RubyGems)](https://junglewise.ai/threats/technologies/lodash-rails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2018-16487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-16487 being exploited in the wild.

**How severe is CVE-2018-16487?** Informational severity, with a CVSS score of 7.5, published 7 February 2019.

**Which products and versions are affected?** lodash (npm) SEMVER:introduced=0,fixed=4.17.11; lodash-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.17.11.

**Is there a fix for CVE-2018-16487?** Yes. lodash (npm): upgrade to 4.17.11 or later; lodash-rails (RubyGems): upgrade to 4.17.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-16487 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-16487?** Check whether you run lodash (npm) or lodash-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lodash (npm): upgrade to 4.17.11 or later

  ```sh
  npm install lodash@4.17.11
  ```

- lodash-rails (RubyGems): upgrade to 4.17.11 or later

  ```sh
  bundle update lodash-rails
  ```


## Technical details

The vulnerability is a prototype pollution (CWE-400) affecting lodash functions defaultsDeep, merge, and mergeWith in versions before 4.17.11. An attacker can craft a malicious object with a constructor.prototype path that, when passed to these merge functions, modifies Object.prototype itself. No authentication or special network access is required—any code that calls these functions with untrusted input is at risk. The attack allows adding or modifying arbitrary properties on all object instances globally, potentially leading to authorization bypasses, logic errors, or other application-level compromises. The fix was released in version 4.17.11 and is available as a patch in the lodash repository.

## Affected products

- lodash lodash before 4.17.11
- lodash lodash-rails before 4.17.11

## Identifiers

- CVE-2018-16487
- GHSA-4xc9-xhrj-v574

## Timeline

- 2019-02-07: disclosed
- 2018: patched: Fixed in lodash 4.17.11

## References

- [https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad](https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad)
- [https://hackerone.com/reports/380873](https://hackerone.com/reports/380873)
- [https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml)
- [https://security.netapp.com/advisory/ntap-20190919-0004](https://security.netapp.com/advisory/ntap-20190919-0004)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash prototype pollution in unset and omit functions](https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions)
- [Lodash prototype pollution in _.unset and _.omit functions](https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash ReDoS in toNumber and trim functions](https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions)
- [lodash prototype pollution in property mutation functions](https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions)