underscore

About

JavaScript's functional programming helper library.

What detecting underscore tells you about a site

Underscore in a live bundle is a fingerprint of age. It predates lodash and was the utility library of the Backbone era, so finding it usually means you are looking at a long-lived codebase that started in the early-to-mid 2010s and never migrated its helpers. Where lodash-es signals deliberate modern tooling, underscore signals continuity: nobody removed it because too much code depends on its _.each, _.template and _.extend. It often travels in legacy admin panels, CMS back-ends and dashboards that have been maintained but not rewritten.

Why the exact underscore version matters

Underscore moved slowly, so versions look similar, but the late 1.x line quietly added modular imports and changed some internal behaviours around iteratee handling. More usefully, the pinned version is an archaeology marker: a very old underscore alongside jQuery and Backbone dates the bundle's origins more precisely than almost any other dependency.

underscore in a real-world stack

When you find underscore in a bundle, it rarely travels alone. Backbone.js and jQuery, the classic pre-React trio.

Quick facts

How Sourcemap Explorer detects underscore

underscore ships as v1.13.8, published 2026-02-19 and carries 0 direct dependencies, 55 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when underscore rides inside a deployed bundle — here is how the detection works.

We catch underscore from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/underscore/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `underscore` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/underscore/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/underscore/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/underscore/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Recent security advisories for underscore

The 2 most recent advisories affecting some versions of underscore, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. HIGHCVE-2026-27601· 2026-03-03

   Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

2. CRITICALCVE-2021-23358· 2021-05-06

   Arbitrary Code Execution in underscore

Recent versions

underscore README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

                   __
                  /\ \                                                         __
 __  __    ___    \_\ \     __   _ __   ____    ___    ___   _ __    __       /\_\    ____
/\ \/\ \ /' _ `\  /'_  \  /'__`\/\  __\/ ,__\  / ___\ / __`\/\  __\/'__`\     \/\ \  /',__\
\ \ \_\ \/\ \/\ \/\ \ \ \/\  __/\ \ \//\__, `\/\ \__//\ \ \ \ \ \//\  __/  __  \ \ \/\__, `\
 \ \____/\ \_\ \_\ \___,_\ \____\\ \_\\/\____/\ \____\ \____/\ \_\\ \____\/\_\ _\ \ \/\____/
  \/___/  \/_/\/_/\/__,_ /\/____/ \/_/ \/___/  \/____/\/___/  \/_/ \/____/\/_//\ \_\ \/___/
                                                                              \ \____/
                                                                               \/___/

FAQ