Loading...
Skip to main content
GeekWala

CVE-2020-28500

MEDIUM

Regular Expression Denial of Service (ReDoS) in lodash

Published January 6, 2022Updated September 29, 2025Source: osv

What Should I Do?

Address in Next Maintenance Window

Low exploitation probability (0.25%). Schedule for your next planned update.

Summary

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. Steps to reproduce (provided by reporter Liyuan Chen): ```js var lo = require('lodash'); function build_blank(n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0); var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1); var time2 = Date.now(); lo.trimEnd(s); var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2); ```

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update lodash-rails to 4.17.21 or later
gem install lodash-rails -v 4.17.21
npm
Update lodash to 4.17.21 or later
npm install lodash@4.17.21
npm
Update lodash-es to 4.17.21 or later
npm install lodash-es@4.17.21

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (5)

PackageEcosystemAffectedFixed In
lodash.trimend
npm
All versionsRange-based data available
lodash.trim
npm
All versionsRange-based data available
lodash-rails
RubyGems
4.0.0, 4.11.2, 4.12.0, 4.13.1 (+16 more)4.17.21
lodash
npm
All versions4.17.21
lodash-es
npm
All versions4.17.21

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Frequently Asked Questions

What is CVE-2020-28500?
Regular Expression Denial of Service (ReDoS) in lodash This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.3/10).
How do I check if my project is affected by CVE-2020-28500?
CVE-2020-28500 affects lodash.trimend, lodash.trim and lodash-rails (and 2 more). It has a 0.2% probability of exploitation within 30 days (EPSS score). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-28500 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.3

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

EPSS Score (30-day exploit probability)
0.25%
Higher than 48% of vulnerabilities

Also Known As

GHSA-29mw-wpgm-hmr9

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies