Critical
Security advisory
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-10744
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:36 UTC · Revision 1
Source evidence
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
osv:CVE-2019-10744
Complete source record
{
"id": "8f54e72c5da4969c17d4aab12221b90b050e4d0313c4afd865811f7d67b7bed2",
"url": "https://osv.dev/vulnerability/CVE-2019-10744",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-10744",
"summary": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"evidence": "osv:CVE-2019-10744",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-10744",
"aliases": [
"CVE-2019-10744",
"GHSA-jf85-cpcp-j695",
"SNYK-JS-LODASH-450202"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/lodash/lodash",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "793f983629f5ccef831360f4d31881bbf6264f8b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.17.12"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"4.17.11-npm",
"4.17.10-npm",
"4.17.9-npm",
"4.17.5-npm",
"4.17.4-npm",
"4.17.3-npm",
"4.17.2-npm",
"4.17.1-npm",
"4.17.0-npm",
"4.16.6-npm",
"4.16.5-npm",
"4.16.4-npm",
"4.16.3-npm",
"4.16.2-npm",
"4.16.1-npm",
"4.16.0-npm",
"4.15.0-npm",
"4.14.2-npm",
"4.14.1-npm",
"4.14.0-npm",
"4.13.1-npm",
"4.13.0-npm",
"4.12.0-npm",
"4.11.2-npm",
"4.11.1-npm",
"4.11.0-npm",
"4.10.0-npm",
"4.9.0-npm",
"4.8.2-npm",
"4.8.1-npm",
"4.8.0-npm",
"4.7.0-npm",
"4.6.1-npm",
"4.6.0-npm",
"4.5.1-npm",
"4.5.0-npm",
"4.4.0-npm",
"4.3.0-npm",
"4.2.1-npm",
"4.2.0-npm",
"4.1.0-npm",
"4.0.1-npm",
"4.0.0-npm",
"3.10.1-npm",
"3.10.0-npm",
"3.9.3-npm",
"3.9.2-npm",
"3.9.1-npm",
"3.9.0-npm",
"3.8.0-npm",
"3.7.0-npm",
"3.6.0-npm",
"3.5.0-npm",
"3.4.0-npm",
"3.3.1-npm",
"3.3.0-npm",
"3.2.0-npm",
"3.1.0-npm",
"3.0.1-npm",
"3.0.0-npm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10744.json"
}
}
],
"modified": "2026-10-24T10:30:31.245236569Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_access_policy_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_advanced_firewall_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_analytics",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.5"
},
{
"introduced": "13.1.0"
},
{
"last_affected": "13.1.3"
},
{
"introduced": "14.1.0"
},
{
"last_affected": "14.1.2"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.3"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_application_acceleration_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_application_security_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_application_visibility_and_reporting",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"last_affected": "13.1.3"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_domain_name_system",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_edge_gateway",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_fraud_protection_service",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_global_traffic_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_link_controller",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_local_traffic_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_policy_enforcement_manager",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-ip_webaccelerator",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"fixed": "12.1.5.2"
},
{
"introduced": "13.1.0"
},
{
"fixed": "13.1.3.4"
},
{
"introduced": "14.1.0"
},
{
"fixed": "14.1.2.5"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.1.4"
},
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-iq_centralized_management",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "f5:big-iq_centralized_management",
"extracted_events": [
{
"range": [
{
"introduced": "5.4.0"
},
{
"last_affected": "5.4.0"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "f5:iworkflow",
"extracted_events": [
{
"range": [
{
"introduced": "2.3.0"
},
{
"last_affected": "2.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_extensibility_workbench",
"extracted_events": [
{
"range": [
{
"introduced": "14.3.0"
},
{
"last_affected": "14.3.0"
},
{
"introduced": "14.4.0"
},
{
"last_affected": "14.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:virtualization_manager",
"extracted_events": [
{
"range": [
{
"introduced": "4.3"
},
{
"last_affected": "4.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-10744",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432750,
"published_at": "2019-07-26T00:15:11.217+00:00"
}