{"id":"CVE-2020-28500","title":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","summary":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"lodash","product":"lodash","affected":["lodash < 4.17.21","banking_corporate_lending_process_management = 14.2.0","banking_corporate_lending_process_management = 14.3.0","banking_corporate_lending_process_management = 14.5.0","banking_credit_facilities_process_management = 14.2.0","banking_credit_facilities_process_management = 14.3.0","banking_credit_facilities_process_management = 14.5.0","banking_extensibility_workbench = 14.2.0","banking_extensibility_workbench = 14.3.0","banking_extensibility_workbench = 14.5.0","banking_supply_chain_finance = 14.2.0","banking_supply_chain_finance = 14.3.0","banking_supply_chain_finance = 14.5.0","banking_trade_finance_process_management = 14.2.0","banking_trade_finance_process_management = 14.3.0","banking_trade_finance_process_management = 14.5.0","communications_cloud_native_core_policy = 1.11.0","communications_design_studio = 7.4.2","communications_services_gatekeeper = 7.0","communications_session_border_controller = 8.4","communications_session_border_controller = 9.0","enterprise_communications_broker = 3.2.0","enterprise_communications_broker = 3.3.0","financial_services_crime_and_compliance_management_studio = 8.0.8.2.0","financial_services_crime_and_compliance_management_studio = 8.0.8.3.0","health_sciences_data_management_workbench = 2.5.2.1","health_sciences_data_management_workbench = 3.0.0.0","jd_edwards_enterpriseone_tools < 9.2.6.1","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","primavera_gateway >= 17.12.0, <= 17.12.11","primavera_gateway >= 18.8.0, <= 18.8.12","primavera_gateway >= 19.12.0, <= 19.12.11","primavera_gateway >= 20.12.0, <= 20.12.7","primavera_unifier >= 17.7, <= 17.12","primavera_unifier = 18.8","primavera_unifier = 19.12","primavera_unifier = 20.12","retail_customer_management_and_segmentation_foundation = 19.0","sinec_ins < 1.0","sinec_ins = 1.0"],"patched":["lodash 4.17.21","jd_edwards_enterpriseone_tools 9.2.6.1","sinec_ins 1.0"],"published":"2021-02-15","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:59.333","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"report@snyk.io"},{"url":"https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","label":"report@snyk.io"},{"url":"https://github.com/lodash/lodash/pull/5065","label":"report@snyk.io"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1018905","label":"report@snyk.io"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"report@snyk.io"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/lodash/lodash/pull/5065","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1018905","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.07336,"epssPercentile":0.94244,"ingestedAt":"2026-10-08T23:16:47.314Z","slug":"CVE-2020-28500","body":"## Overview\n\nLodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.\n\n## Affected\n\n- `lodash < 4.17.21`\n- `banking_corporate_lending_process_management = 14.2.0`\n- `banking_corporate_lending_process_management = 14.3.0`\n- `banking_corporate_lending_process_management = 14.5.0`\n- `banking_credit_facilities_process_management = 14.2.0`\n- `banking_credit_facilities_process_management = 14.3.0`\n- `banking_credit_facilities_process_management = 14.5.0`\n- `banking_extensibility_workbench = 14.2.0`\n- `banking_extensibility_workbench = 14.3.0`\n- `banking_extensibility_workbench = 14.5.0`\n- `banking_supply_chain_finance = 14.2.0`\n- `banking_supply_chain_finance = 14.3.0`\n- `banking_supply_chain_finance = 14.5.0`\n- `banking_trade_finance_process_management = 14.2.0`\n- `banking_trade_finance_process_management = 14.3.0`\n- `banking_trade_finance_process_management = 14.5.0`\n- `communications_cloud_native_core_policy = 1.11.0`\n- `communications_design_studio = 7.4.2`\n- `communications_services_gatekeeper = 7.0`\n- `communications_session_border_controller = 8.4`\n- `communications_session_border_controller = 9.0`\n- `enterprise_communications_broker = 3.2.0`\n- `enterprise_communications_broker = 3.3.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0`\n- `health_sciences_data_management_workbench = 2.5.2.1`\n- `health_sciences_data_management_workbench = 3.0.0.0`\n- `jd_edwards_enterpriseone_tools < 9.2.6.1`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `primavera_gateway >= 17.12.0, <= 17.12.11`\n- `primavera_gateway >= 18.8.0, <= 18.8.12`\n- `primavera_gateway >= 19.12.0, <= 19.12.11`\n- `primavera_gateway >= 20.12.0, <= 20.12.7`\n- `primavera_unifier >= 17.7, <= 17.12`\n- `primavera_unifier = 18.8`\n- `primavera_unifier = 19.12`\n- `primavera_unifier = 20.12`\n- `retail_customer_management_and_segmentation_foundation = 19.0`\n- `sinec_ins < 1.0`\n- `sinec_ins = 1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lodash 4.17.21`\n- `jd_edwards_enterpriseone_tools 9.2.6.1`\n- `sinec_ins 1.0`","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":29.2,"likelihood":1.5,"exploitation":0,"ransomware":0},"changes":[]}