Medium 5.3Published Feb 15, 2021

CVE-2020-28500Regular Expression Denial of Service (ReDoS)

Updated under an hour ago (Oct 27, 2026, 4:30 AM ET)

Does this affect you?

It affects lodash and 18 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for lodash

Exploited in the last 30 days

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: snyk
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

lodash lodash lodash:lodash	before 4.17.21	NVD
oracle banking_corporate_lending_process_management oracle:banking_corporate_lending_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_credit_facilities_process_management oracle:banking_credit_facilities_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_extensibility_workbench oracle:banking_extensibility_workbench	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_supply_chain_finance oracle:banking_supply_chain_finance	14.2.0; 14.3.0; 14.5.0	NVD
oracle banking_trade_finance_process_management oracle:banking_trade_finance_process_management	14.2.0; 14.3.0; 14.5.0	NVD
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy	1.11.0	NVD
oracle communications_design_studio oracle:communications_design_studio	7.4.2	NVD
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper	7.0	NVD
oracle communications_session_border_controller oracle:communications_session_border_controller	8.4; 9.0	NVD
1–10 of 19

References

References

https://snyk.io/vuln/SNYK-JS-LODASH-1018905	x-refsource-misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892	x-refsource-misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893	x-refsource-misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894	x-refsource-misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895	x-refsource-misc
https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896	x-refsource-misc
https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8	x-refsource-misc
https://github.com/lodash/lodash/pull/5065	x-refsource-misc
https://www.oracle.com//security-alerts/cpujul2021.html	x-refsource-misc
https://security.netapp.com/advisory/ntap-20210312-0006/	x-refsource-confirm
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.