Lodash 4.17 Release Notes

3 versions

Comprehensive release notes and changelog for Lodash 4.17, including security patches, bug fixes, and feature updates across all supported versions.

Apr 9, 2026

Latest: 4.17.25

3 Patched Vulnerabilities

April 2026

Released Apr 9, 2026

Full Version:

4.17.23-lodash-4.17.25

This release contains backported security fixes to remediate two vulnerabilities.
Full version: @neverendingsupport/lodash@4.17.23-lodash-4.17.25

_.unset:
- Block unsafe traversal via constructor and prototype.
  - This fixes a moderate-severity Prototype Pollution vulnerability (CVE-2026-2950).
_.omit:
- Block unsafe traversal via constructor and prototype.
  - This fixes a moderate-severity Prototype Pollution vulnerability (CVE-2026-2950).
_.template:
- Harden against code injection via options.imports.
  - This fixes a high-severity Code Injection vulnerability (CVE-2026-4800).