CVE-2026-2950: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2950 is a prototype pollution vulnerability in the Lodash JavaScript utility library affecting the _.unset and _.omit functions. It impacts Lodash (lodash, lodash-es, lodash-amd, lodash.unset) versions 4.17.23 and earlier, and is patched in version 4.18.0. The vulnerability is a bypass of the fix introduced for CVE-2025-13465, which only guarded against string key members in path segments. It was published on March 31, 2026, with a CVSS v3.1 base score of 5.3 (Medium) per NVD, or 6.5 (Medium) per the GitHub Advisory Database (GitHub Advisory, Feedly).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). The prior fix for CVE-2025-13465 only validated string-typed path keys, leaving a gap: an attacker can pass array-wrapped path segments (e.g., ['__proto__', 'polluted']) to bypass the guard and invoke _.unset or _.omit on built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. This allows deletion of prototype properties globally within the JavaScript runtime, though it does not permit overwriting or redefining those properties. The attack requires no authentication or user interaction and is exploitable over the network (GitHub Advisory, Lodash Advisory).

Successful exploitation allows an unauthenticated remote attacker to delete properties from JavaScript built-in prototypes, which can cause application malfunction, unexpected behavior, or denial of service conditions in any Node.js application relying on the affected Lodash functions. The vulnerability has no confidentiality impact but carries low integrity and availability impacts, as removing prototype properties can break core JavaScript functionality relied upon by the application. The broad adoption of Lodash across the npm ecosystem means the blast radius is significant, with IBM issuing advisories for dozens of affected products including IBM Maximo Application Suite, IBM App Connect Enterprise, IBM QRadar, IBM Aspera Faspex, IBM Security SOAR, and many others (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (plugin 304822) and Qualys (multiple detection IDs) (Feedly).

1. Identify target: Locate a Node.js application that uses Lodash version 4.17.23 or earlier and exposes an endpoint that passes user-controlled input to _.unset() or _.omit().
2. Craft malicious path: Construct an array-wrapped path segment that targets a built-in prototype property, such as ['__proto__', 'toString'] or ['constructor', 'prototype', 'hasOwnProperty'].
3. Submit payload: Send the crafted path as input to the vulnerable application endpoint — for example, via a JSON body, query parameter, or API call that is processed by _.unset(obj, ['__proto__', 'targetProp']) or _.omit(obj, [['__proto__', 'targetProp']]).
4. Trigger prototype deletion: Lodash processes the array-wrapped path without the string-key guard, causing the specified property to be deleted from the global prototype (e.g., Object.prototype.toString is removed).
5. Achieve impact: Subsequent application code that relies on the deleted prototype method will throw errors or behave unexpectedly, potentially causing denial of service or application logic bypass (GitHub Advisory).

The only remediation is to upgrade Lodash to version 4.18.0 or later; no workarounds are available (GitHub Advisory). This applies to all affected packages: lodash, lodash-es, lodash-amd, and lodash.unset. Organizations using IBM products that bundle vulnerable Lodash versions should apply the relevant IBM security bulletins as they are released. Priority should be given to internet-facing Node.js applications that accept user-controlled input processed by _.unset or _.omit.

IBM has issued a large number of security bulletins (30+) covering affected products including IBM Maximo Application Suite, IBM App Connect Enterprise, IBM QRadar Suite, IBM Aspera Faspex, IBM Security SOAR, IBM Watson Discovery, and many others, reflecting the widespread use of Lodash across enterprise software (IBM Advisory). Oracle also referenced the CVE in its May 2026 Critical Patch Update advisory. Ubuntu issued security notice USN-8411-1 and Red Hat issued RHSA-2026:24841 addressing the vulnerability in their respective ecosystems (Ubuntu Advisory, Red Hat Advisory).