The vulnerabilities of the merge, mergeWith, and defaultsDeep functions in the Lodash library allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

🗓️ 31 Aug 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

Uncontrolled resource use in lodash merge, mergeWith, and defaultsDeep risks confidentiality and integrity.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities	18 Jul 202306:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Prototype Pollution flaw due to lodash.clonedeep	17 Dec 202510:49	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of the lodash library	17 Apr 202613:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilties in IBM Rational Functional Tester / DevOps Test UI	4 Jun 202619:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software	14 Jan 202612:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform	26 Jan 202317:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by vulnerabilities in the shipped Node runtime	29 Mar 201910:55	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability affects IBM Cloud Object Storage SDK NodeJS (Mar 2019)	23 Jul 201920:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring WebFlux, Jenkins, Spring Securiy, Spring Framework, and Node.js lodash might affect IBM Storage Defender Copy Data Management.	5 May 202618:22	–	ibm

Vulners

Node

john-david_dalton lodashRange<4.17.11

OR

ibm ibm_planning_analytics_workspaceRange<2.0.72

Source	Link
ibm	www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-workspace-is-affected-by-security-vulnerabilities-14/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-16487
hackerone	www.hackerone.com/reports/380873
web	www.web.nvd.nist.gov/view/vuln/detail

01 Jun 2026 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 35.6

CVSS 26.8

EPSS0.01553

lodash merge mergeWith defaultsDeep resource exhaustion confidentiality integrity