npm

lodash.unset

Security advisories for lodash.unset, newest first. 2 known, 1 without a fix yet.

RSS feed Check your lock file →

Latest version

4.18.0

Advisories

2 · 1 unfixed

Last advisory

1 Apr 2026

Safe from

no fix for all yet

2 advisories · newest first

MODERATE6.5 1 Apr 2026

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

GHSA-f23m-r3pf-42rh · CVE-2026-2950

Affected

≥ 4.0.0, < 4.18.0

Fixed in

4.18.0

Published

1 Apr 2026

MODERATE6.5 21 Jan 2026

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

GHSA-xxjr-mmjv-4gpg · CVE-2025-13465

Affected

≥ 4.0.0, ≤ 4.5.2

Fixed in

no fix yet

Published

21 Jan 2026

/advisories/npm/lodash.unset/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →