| Package | Affected versions | Patched versions |
|---|---|---|
| lodash-rails | ≥ 4.7.0, < 4.17.11 | 4.17.11 |
| lodash | < 4.17.11 | 4.17.11 |
| lodash | ≥ 4.7.0, < 4.17.11 | 4.17.11 |
| lodash-amd | ≥ 4.7.0, < 4.17.11 | 4.17.11 |
| lodash-es | ≥ 4.7.0, < 4.17.11 | 4.17.11 |
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free