CVE-2026-2950 lodash CVE debrief

Who should care

Developers and security teams using Lodash versions 4.17.23 or earlier should be aware of this vulnerability and take steps to upgrade to a patched version. This includes reviewing and updating affected projects, monitoring for potential exploitation attempts, and ensuring that security teams are informed about the potential risks.

Technical summary

The vulnerability exists in the _.unset and _.omit functions of Lodash, allowing an attacker to bypass the fix for CVE-2025-13465 by passing array-wrapped path segments. This enables deletion of properties from built-in prototypes. The issue has a CVSS score of 6.5 and is classified as medium severity. The vulnerability is patched in version 4.18.0. Affected systems may allow deletion of prototype properties but do not allow overwriting their original behavior.

Defensive priority

Upgrade to Lodash version 4.18.0 or later to mitigate this vulnerability. Review and update affected projects, and monitor for potential exploitation attempts.

Recommended defensive actions

• Upgrade to Lodash version 4.18.0 or later
• Review and update affected projects
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T20:16:26.207Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. This vulnerability affects Lodash versions 4.17.23 and earlier, allowing for prototype pollution via the _.unset and _.omit functions. The issue permits deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype but does not allow overwriting their original behavior. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. Developers and security teams should verify their use of affected Lodash versions and plan for upgrades or mitigations.

Official resources