lodash-es

About

Lodash exported as ES modules.

What detecting lodash-es tells you about a site

Spotting lodash-es rather than plain lodash tells you the team cares about bundle size and tree-shaking. It is the ES-module build, so individual functions like debounce or cloneDeep can be statically analysed and dropped if unused, which only matters to someone who has thought about what ships to the browser. Its presence usually points to a modern bundler (Vite, Rollup, esbuild, webpack 5) and a codebase that leans on utility functions for collections, deep cloning and throttling rather than reimplementing them. It is a pragmatic, slightly old-school choice: a team comfortable with a big toolbox over hand-rolled helpers.

Why the exact lodash-es version matters

Lodash has been stable for years, so the major version rarely shifts behaviour, but the exact build still matters for one reason: prototype-pollution advisories have hit specific patch ranges over the library's history. Seeing an old pinned version can flag an unpatched dependency. The es variant also signals whether the team adopted the tree-shakeable distribution early or late, which is a small dating clue about when the front-end tooling was last modernised.

lodash-es in a real-world stack

When you find lodash-es in a bundle, it rarely travels alone. Modern bundlers like Vite or Rollup, and often alongside date and validation utilities in the same toolbelt.

Quick facts

How Sourcemap Explorer detects lodash-es

lodash-es ships as v4.18.1, published 2026-04-01 and carries 0 direct dependencies, 71 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when lodash-es rides inside a deployed bundle — here is how the detection works.

We catch lodash-es from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/lodash-es/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `lodash-es` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/lodash-es/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/lodash-es/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/lodash-es/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of lodash-es

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the lodash-es version a site actually ships against the ecosystem.

Recent security advisories for lodash-es

The 5 most recent advisories affecting some versions of lodash-es, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. HIGHCVE-2021-23337· 2026-04-01

   lodash vulnerable to Code Injection via `_.template` imports key names

2. MODERATECVE-2025-13465· 2026-04-01

   lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

3. MODERATECVE-2025-13465· 2026-01-21

   Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

4. MODERATECVE-2020-28500· 2022-01-06

   Regular Expression Denial of Service (ReDoS) in lodash

5. HIGHCVE-2021-23337· 2021-05-06

   Command Injection in lodash

Recent versions

lodash-es README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

$ npm run build
$ lodash -o ./dist/lodash.js
$ lodash core -o ./dist/lodash.core.js

<script src="lodash.js"></script>

$ npm i -g npm
$ npm i --save lodash

// Load the full build.
var _ = require('lodash');
// Load the core build.
var _ = require('lodash/core');
// Load the FP build for immutable auto-curried iteratee-first data-last methods.
var fp = require('lodash/fp');

// Load method categories.
var array = require('lodash/array');
var object = require('lodash/fp/object');

// Cherry-pick methods for smaller browserify/rollup/webpack bundles.
var at = require('lodash/at');
var curryN = require('lodash/fp/curryN');

FAQ