lodash

About

Lodash modular utilities.

What detecting lodash tells you about a site

lodash is the classic utility belt, and its presence — especially the full lodash rather than lodash-es — often signals an older or bundle-size-unconscious build, since most of its functions now have native or tree-shakeable equivalents. Spotting the full package frequently means the whole library was imported for a handful of helpers.

Why the exact lodash version matters

lodash has a notable security history, including prototype-pollution CVEs fixed in 4.17.12, .19 and .21. Reading the exact bundled version is a direct check for whether the site ships a patched 4.17.21 or an older, vulnerable release — a common finding on long-lived apps.

lodash in a real-world stack

When you find lodash in a bundle, it rarely travels alone. Frequently bundled transitively by older dependencies even when the app code doesn't import it directly.

Quick facts

How Sourcemap Explorer detects lodash

lodash ships as v4.18.1, published 2026-04-01 and carries 0 direct dependencies, 117 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when lodash rides inside a deployed bundle — here is how the detection works.

We catch lodash from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/lodash/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `lodash` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/lodash/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/lodash/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/lodash/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of lodash

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the lodash version a site actually ships against the ecosystem.

Recent security advisories for lodash

The 5 most recent advisories affecting some versions of lodash, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. HIGHCVE-2021-23337· 2026-04-01

   lodash vulnerable to Code Injection via `_.template` imports key names

2. MODERATECVE-2025-13465· 2026-04-01

   lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

3. MODERATECVE-2025-13465· 2026-01-21

   Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

4. MODERATECVE-2020-28500· 2022-01-06

   Regular Expression Denial of Service (ReDoS) in lodash

5. HIGHCVE-2021-23337· 2021-05-06

   Command Injection in lodash

Recent versions

lodash README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

$ npm run build
$ lodash -o ./dist/lodash.js
$ lodash core -o ./dist/lodash.core.js

<script src="lodash.js"></script>

$ npm i -g npm
$ npm i --save lodash

// Load the full build.
var _ = require('lodash');
// Load the core build.
var _ = require('lodash/core');
// Load the FP build for immutable auto-curried iteratee-first data-last methods.
var fp = require('lodash/fp');

// Load method categories.
var array = require('lodash/array');
var object = require('lodash/fp/object');

// Cherry-pick methods for smaller browserify/rollup/webpack bundles.
var at = require('lodash/at');
var curryN = require('lodash/fp/curryN');

FAQ