CVE-2020-28500
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
- CVSS 3.1
- 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - EPSS
- 7.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lodash:lodash
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_extensibility_workbench
- oracle:banking_supply_chain_finance
- oracle:banking_trade_finance_process_management
- oracle:communications_cloud_native_core_policy
- oracle:communications_design_studio
- oracle:communications_services_gatekeeper
- oracle:communications_session_border_controller
- oracle:enterprise_communications_broker
- oracle:financial_services_crime_and_compliance_management_studio
- oracle:health_sciences_data_management_workbench
- oracle:jd_edwards_enterpriseone_tools
- oracle:peoplesoft_enterprise_peopletools
- oracle:primavera_gateway
- oracle:primavera_unifier
- oracle:retail_customer_management_and_segmentation_foundation
- siemens:sinec_ins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-29mw-wpgm-hmr9 | npm | lodash | >=4.0.0 <4.17.21 | 4.17.21 |
| GHSA-29mw-wpgm-hmr9 | npm | lodash-es | >=4.0.0 <4.17.21 | 4.17.21 |
| GHSA-29mw-wpgm-hmr9 | npm | lodash.trimend | >=4.0.0 <=4.5.1 | no fix published |
| GHSA-29mw-wpgm-hmr9 | npm | lodash.trim | >=4.0.0 <=4.5.1 | no fix published |
| GHSA-29mw-wpgm-hmr9 | RubyGems | lodash-rails | >=4.0.0 <4.17.21 | 4.17.21 |