# CVE-2026-2950: Lodash prototype pollution in unset and omit functions

Source: https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-2950 · Severity: medium · CVSS 6.5 · Published 2026-03-31

Lodash, a widely used JavaScript utility library, is vulnerable to a security flaw that allows attackers to delete properties from global object prototypes. By providing specially crafted input to certain functions, an attacker could potentially disable core application features or cause service instability. This issue is a bypass of a previous security fix and affects applications that process untrusted user input through Lodash's data manipulation tools.

Technologies: [Lodash-Amd](https://junglewise.ai/threats/technologies/lodash-amd), [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-es (npm)](https://junglewise.ai/threats/technologies/lodash-es). Vendors: [Lodash](https://junglewise.ai/threats/vendors/lodash), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-2950 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2950 being exploited in the wild.

**How severe is CVE-2026-2950?** Medium severity, with a CVSS score of 6.5, published 31 March 2026.

**Which products and versions are affected?** Lodash-Amd >= 4.0.0, < 4.18.0; Lodash.Unset >= 4.0.0, < 4.18.0; lodash (npm) = 4.17.23; lodash-amd (npm) = 4.17.23; and 3 more.

**Is there a fix for CVE-2026-2950?** A patch was published on 2026-03-31: Fixed in version 4.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2950 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2950?** Check whether you run Lodash-Amd, Lodash.Unset, lodash (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A prototype pollution vulnerability exists in Lodash's _.unset and _.omit functions due to an incomplete fix for a previous vulnerability (CVE-2025-13465). While the previous fix guarded against string-based keys, attackers can bypass this by passing array-wrapped path segments. This allows an unauthenticated remote attacker to delete properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. While this does not allow for property overwriting or direct code execution, it can lead to denial of service or application logic bypasses by removing essential methods. The issue is addressed in version 4.18.0.

## Affected products

- lodash lodash >= 4.0.0, < 4.18.0
- lodash lodash-es >= 4.0.0, < 4.18.0
- lodash lodash-amd >= 4.0.0, < 4.18.0
- lodash lodash.unset >= 4.0.0, < 4.18.0

## Identifiers

- CVE-2026-2950
- GHSA-f23m-r3pf-42rh

## Timeline

- 2026-01-21: advisory: Initial advisory for related CVE-2025-13465 published
- 2026-03-31: disclosed: CVE-2026-2950 disclosed as a bypass of the previous fix
- 2026-03-31: patched: Fixed in version 4.18.0

## References

- [https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash code injection in _.template imports](https://junglewise.ai/threats/cve-2026-4800-lodash-code-injection-in-template-imports)
- [Lodash prototype pollution in _.unset and _.omit functions](https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash ReDoS in toNumber and trim functions](https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions)
- [lodash prototype pollution in property mutation functions](https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions)