CVE-2020-28500

CVE-2020-28500 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS 5.3 · Medium · EPSS 7.3% · Fix available

Stack: system · node

Affected products and versions

lodash
Versions
- versions prior to 4.17.21: Affected
No fix published
node-lodash Debian:12
Affected ranges
- ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1
Update to 4.17.21+dfsg+~cs8.31.173-1
node-lodash Debian:13
Affected ranges
- ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1
Update to 4.17.21+dfsg+~cs8.31.173-1
node-lodash Debian:14
Affected ranges
- ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1
Update to 4.17.21+dfsg+~cs8.31.173-1
lodash npm
Affected ranges
- SEMVER: ≥ 4.0.0, < 4.17.21
Update to 4.17.21
lodash-es npm
Affected ranges
- SEMVER: ≥ 4.0.0, < 4.17.21
Update to 4.17.21
lodash.trimend npm
Affected ranges
- SEMVER: ≥ 4.0.0, ≤ 4.5.1
No fix published
lodash.trim npm
Affected ranges
- SEMVER: ≥ 4.0.0, ≤ 4.5.1
No fix published
lodash-rails RubyGems
Versions
- 4.0.0
- 4.11.2
- 4.12.0
- 4.13.1
- 4.14.1
- 4.15.0
- 4.16.1
- 4.16.3
- 4.16.4
- 4.16.6
- 4.17.10
- 4.17.11
- 4.17.14
- 4.17.15
- 4.17.2
- 4.17.4
- 4.17.5
- 4.3.0
- 4.5.1
- 4.6.1
Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.17.21
Update to 4.17.21
node-lodash Ubuntu:Pro:18.04:LTS
Versions
- 4.17.4+dfsg-1
Affected ranges
- ECOSYSTEM: < 4.17.4+dfsg-1ubuntu0.1~esm1
Update to 4.17.4+dfsg-1ubuntu0.1~esm1
node-lodash Ubuntu:Pro:20.04:LTS
Versions
- 4.17.11+dfsg-4
- 4.17.15+dfsg-2
Affected ranges
- ECOSYSTEM: < 4.17.15+dfsg-2ubuntu0.1~esm1
Update to 4.17.15+dfsg-2ubuntu0.1~esm1