--- id: CVE-2020-28500 title: >- Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. summary: >- Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. severity: medium cvss: 5.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L' vendor: lodash product: lodash affected: - lodash < 4.17.21 - banking_corporate_lending_process_management = 14.2.0 - banking_corporate_lending_process_management = 14.3.0 - banking_corporate_lending_process_management = 14.5.0 - banking_credit_facilities_process_management = 14.2.0 - banking_credit_facilities_process_management = 14.3.0 - banking_credit_facilities_process_management = 14.5.0 - banking_extensibility_workbench = 14.2.0 - banking_extensibility_workbench = 14.3.0 - banking_extensibility_workbench = 14.5.0 - banking_supply_chain_finance = 14.2.0 - banking_supply_chain_finance = 14.3.0 - banking_supply_chain_finance = 14.5.0 - banking_trade_finance_process_management = 14.2.0 - banking_trade_finance_process_management = 14.3.0 - banking_trade_finance_process_management = 14.5.0 - communications_cloud_native_core_policy = 1.11.0 - communications_design_studio = 7.4.2 - communications_services_gatekeeper = 7.0 - communications_session_border_controller = 8.4 - communications_session_border_controller = 9.0 - enterprise_communications_broker = 3.2.0 - enterprise_communications_broker = 3.3.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.2.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.3.0 - health_sciences_data_management_workbench = 2.5.2.1 - health_sciences_data_management_workbench = 3.0.0.0 - jd_edwards_enterpriseone_tools < 9.2.6.1 - peoplesoft_enterprise_peopletools = 8.58 - peoplesoft_enterprise_peopletools = 8.59 - 'primavera_gateway >= 17.12.0, <= 17.12.11' - 'primavera_gateway >= 18.8.0, <= 18.8.12' - 'primavera_gateway >= 19.12.0, <= 19.12.11' - 'primavera_gateway >= 20.12.0, <= 20.12.7' - 'primavera_unifier >= 17.7, <= 17.12' - primavera_unifier = 18.8 - primavera_unifier = 19.12 - primavera_unifier = 20.12 - retail_customer_management_and_segmentation_foundation = 19.0 - sinec_ins < 1.0 - sinec_ins = 1.0 patched: - lodash 4.17.21 - jd_edwards_enterpriseone_tools 9.2.6.1 - sinec_ins 1.0 published: '2021-02-15' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:16:59.333' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-28500' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: report@snyk.io - url: 'https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8' label: report@snyk.io - url: 'https://github.com/lodash/lodash/pull/5065' label: report@snyk.io - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1018905' label: report@snyk.io - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: report@snyk.io - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/lodash/lodash/pull/5065' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1018905' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.07336 epssPercentile: 0.94244 ingestedAt: '2026-10-08T23:16:47.314Z' --- ## Overview Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. ## Affected - `lodash < 4.17.21` - `banking_corporate_lending_process_management = 14.2.0` - `banking_corporate_lending_process_management = 14.3.0` - `banking_corporate_lending_process_management = 14.5.0` - `banking_credit_facilities_process_management = 14.2.0` - `banking_credit_facilities_process_management = 14.3.0` - `banking_credit_facilities_process_management = 14.5.0` - `banking_extensibility_workbench = 14.2.0` - `banking_extensibility_workbench = 14.3.0` - `banking_extensibility_workbench = 14.5.0` - `banking_supply_chain_finance = 14.2.0` - `banking_supply_chain_finance = 14.3.0` - `banking_supply_chain_finance = 14.5.0` - `banking_trade_finance_process_management = 14.2.0` - `banking_trade_finance_process_management = 14.3.0` - `banking_trade_finance_process_management = 14.5.0` - `communications_cloud_native_core_policy = 1.11.0` - `communications_design_studio = 7.4.2` - `communications_services_gatekeeper = 7.0` - `communications_session_border_controller = 8.4` - `communications_session_border_controller = 9.0` - `enterprise_communications_broker = 3.2.0` - `enterprise_communications_broker = 3.3.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0` - `health_sciences_data_management_workbench = 2.5.2.1` - `health_sciences_data_management_workbench = 3.0.0.0` - `jd_edwards_enterpriseone_tools < 9.2.6.1` - `peoplesoft_enterprise_peopletools = 8.58` - `peoplesoft_enterprise_peopletools = 8.59` - `primavera_gateway >= 17.12.0, <= 17.12.11` - `primavera_gateway >= 18.8.0, <= 18.8.12` - `primavera_gateway >= 19.12.0, <= 19.12.11` - `primavera_gateway >= 20.12.0, <= 20.12.7` - `primavera_unifier >= 17.7, <= 17.12` - `primavera_unifier = 18.8` - `primavera_unifier = 19.12` - `primavera_unifier = 20.12` - `retail_customer_management_and_segmentation_foundation = 19.0` - `sinec_ins < 1.0` - `sinec_ins = 1.0` ## Remediation Upgrade past the affected range: - `lodash 4.17.21` - `jd_edwards_enterpriseone_tools 9.2.6.1` - `sinec_ins 1.0`