# CVE-2020-28500: lodash ReDoS in toNumber and trim functions

Source: https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-06. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2020-28500 · Severity: low · CVSS 3.1 · Published 2022-01-06

Lodash, a widely used JavaScript utility library, is vulnerable to a denial-of-service flaw when processing specifically crafted large strings. An attacker can exploit this by providing long strings to certain text-processing functions, causing the application to consume excessive CPU resources and become unresponsive. This can lead to service outages or significant performance degradation for web applications using affected versions of the library.

Technologies: [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-es (npm)](https://junglewise.ai/threats/technologies/lodash-es), [lodash-rails (RubyGems)](https://junglewise.ai/threats/technologies/lodash-rails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2020-28500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28500 being exploited in the wild.

**How severe is CVE-2020-28500?** Low severity, with a CVSS score of 3.1, published 6 January 2022.

**Which products and versions are affected?** lodash (npm) SEMVER:introduced=4.0.0,fixed=4.17.21; lodash-es (npm) SEMVER:introduced=4.0.0,fixed=4.17.21; lodash.trim (npm) SEMVER:introduced=4.0.0,last_affected=4.5.1; lodash.trimend (npm) SEMVER:introduced=4.0.0,last_affected=4.5.1; and 1 more.

**Is there a fix for CVE-2020-28500?** Yes. lodash (npm): upgrade to 4.17.21 or later; lodash-es (npm): upgrade to 4.17.21 or later; lodash-rails (RubyGems): upgrade to 4.17.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28500 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-28500?** Check whether you run lodash (npm), lodash-es (npm), lodash.trim (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lodash (npm): upgrade to 4.17.21 or later

  ```sh
  npm install lodash@4.17.21
  ```

- lodash-es (npm): upgrade to 4.17.21 or later

  ```sh
  npm install lodash-es@4.17.21
  ```

- lodash-rails (RubyGems): upgrade to 4.17.21 or later

  ```sh
  bundle update lodash-rails
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lodash versions 4.0.0 through 4.17.20. The vulnerability is rooted in the use of inefficient regular expressions (specifically those handling whitespace trimming like /\s+$/) within the `toNumber`, `trim`, and `trimEnd` functions. An attacker can trigger catastrophic backtracking by passing a large string (e.g., ~50KB) containing a specific pattern of characters and trailing whitespace. This results in high CPU utilization and thread blocking, leading to a denial of service. The issue is fixed in version 4.17.21 by optimizing the string processing logic to avoid vulnerable regex patterns.

## Affected products

- lodash lodash >= 4.0.0, < 4.17.21
- lodash lodash-es >= 4.0.0, < 4.17.21
- lodash lodash.trim <= 4.5.1
- lodash lodash.trimend <= 4.5.1
- lodash-rails lodash-rails >= 4.0.0, < 4.17.21

## Identifiers

- CVE-2020-28500
- GHSA-29mw-wpgm-hmr9

## Timeline

- 2021-01-26: other: Initial performance improvement PR submitted to lodash
- 2021-02-15: advisory: NVD published CVE-2020-28500
- 2021-02-20: patched: Fix merged into lodash 4.17 branch
- 2022-01-06: disclosed: GitHub Advisory published

## References

- [https://github.com/lodash/lodash/pull/5065](https://github.com/lodash/lodash/pull/5065)
- [https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7](https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7)
- [https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a](https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a)
- [https://www.oracle.com/security-alerts/cpuoct2021.html](https://www.oracle.com/security-alerts/cpuoct2021.html)
- [https://www.oracle.com/security-alerts/cpujul2022.html](https://www.oracle.com/security-alerts/cpujul2022.html)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash prototype pollution in unset and omit functions](https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions)
- [Lodash prototype pollution in _.unset and _.omit functions](https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash prototype pollution in property mutation functions](https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions)
- [lodash regular expression denial of service in date handler](https://junglewise.ai/threats/cve-2019-1010266-lodash-regular-expression-denial-of-service-in-date-handler)