CVE-2019-10744 – Prototype Pollution in lodash

CVSS 9.1 critical: Prototype Pollution in lodash < 4.17.12. Affects JavaScript applications.

CVE-2019-10744 describes a Prototype Pollution vulnerability in lodash versions lower than 4.17.12. The defaultsDeep function can be tricked into adding or modifying properties of Object.prototype using a constructor payload, compromising the behavior of all object instances in JavaScript throughout the application. It directly affects JavaScript applications that depend on lodash.

The CVSS score is 9.1 (critical). The vulnerability was published on July 26, 2019 by NVD. The patch is available since version 4.17.12. Technical analysis of the vulnerability has been documented in November 2026, confirming ongoing research interest in this vulnerability.

Immediate defense: verify lodash in direct and transitive dependencies. Upgrade to 4.17.12 or higher across all environments. Check build history and deployments for traces of Prototype Pollution. Implement Object.prototype integrity controls during inbound data validation; monitor anomalous access to inherited properties.

At a glance

What: Prototype Pollution in lodash defaultsDeep function. A constructor payload can modify Object.prototype, compromising the behavior of all object instances in JavaScript throughout the application.
Severity: CVSS 9.1 (critical). Critical-impact vulnerability for JavaScript applications depending on lodash.
Affected versions: lodash versions < 4.17.12. Patch available since version 4.17.12.
Fix: Update to lodash 4.17.12 or later across all production and development environments.
Status: Published July 26, 2019 on NVD. Technical analysis documented in November 2026.
Action: Verify lodash in direct and transitive dependencies. Update to 4.17.12+ immediately. Implement Object.prototype integrity controls during inbound data validation.

Sources: NVD, CVE-2019-10744

← All articles