CVE-2018-16487: Lodash

Medium severity, CVSS 5.6. EPSS: 1.6% chance of exploitation in the next 30 days.

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Affected products

• Lodash Lodash: before 4.17.11 (fixed in 4.17.11)

Published 2019-02-01. Last modified 2026-06-17.