npm package report

Is lodash safe?

8 known vulnerabilities, worst severity CRITICAL.

// advisories

fig. 01, known advisories affecting lodash

GHSA-f23m-r3pf-42rhMODERATE2026-04-01

Affected >=4.0.0, <4.17.23 · fixed in 4.18.0

GHSA-xxjr-mmjv-4gpgMODERATE2026-01-21

Affected >=4.0.0, <4.18.0 · fixed in 4.17.23

GHSA-35jh-r3h4-6jhmHIGH2021-05-06

Affected >=4.0.0, <4.18.0 · fixed in 4.17.21

GHSA-r5fr-rjxr-66jcHIGH2026-04-01

Affected >=0, <4.17.21 · fixed in 4.18.0

GHSA-4xc9-xhrj-v574HIGH2019-02-07

Affected < 4.17.11 · fixed in 4.17.11

GHSA-fvqr-27wr-82fmMODERATE2018-07-26

Affected < 4.17.5 · fixed in 4.17.5

GHSA-p6mc-m468-83gwHIGH2020-07-15

Affected >= 3.7.0, < 4.17.19 · fixed in 4.17.19

GHSA-jf85-cpcp-j695CRITICAL2019-07-10

Affected < 4.17.12 · fixed in 4.17.12

// dependencies

0 direct

// ai model usage

Model usage is tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

checked 2026-09-21 22:27 UTC · most recent advisory 2026-04-01 · updated continuously from NVD, GHSA, OSV and CNA feeds

Is lodash safe? npm package security report | CyberXYZ