CVE-2019-1010266 Regular Expression Denial of Service (ReDoS) in lodash
An attacker can cause a denial of service by providing long strings that trigger excessive resource consumption in the Date handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1010266?
CVE-2019-1010266 is a medium-severity denial of service vulnerability in lodash, published on 17 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Which versions are affected by CVE-2019-1010266?
8 open source packages ship an affected version, including lodash-rails, lodash and lodash-amd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | From 4.7.0 | 4.17.11 |
lodash-rails RubyGems | From 4.7.0 | 4.17.11 |
lodash npm | From 4.7.0 | 4.17.11 |
lodash npm | From 4.7.0 | 4.17.11 |
lodash-amd npm | From 4.7.0 | 4.17.11 |
lodash-amd npm | From 4.7.0 | 4.17.11 |
2 more packages
lodash-es npm | From 4.7.0 | 4.17.11 |
lodash-es npm | From 4.7.0 | 4.17.11 |
Products include Lodash Lodash.
How do I fix CVE-2019-1010266?
Upgrade lodash-rails to 4.17.11 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-1010266 being exploited?
There is no known exploitation of CVE-2019-1010266 in the wild and no public exploit code.
Other vulnerabilities in lodash
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Sources
Also known as AZL-45159, DEBIAN-CVE-2019-1010266, GHSA-x5rq-j2xg-h7qm, SNYK-JS-LODASH-73639, UBUNTU-CVE-2019-1010266.