HeroDevs

Underscore 1.9.x Release Notes

3 versions

Comprehensive release notes and changelog for Underscore 1.9.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 21, 2026
Latest: 1.9.5
2 Patched Vulnerabilities
VEX Statements

August 2026

1.9.5

Released Aug 21, 2026
CVE-2021-23358

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/underscore@1.9.2-underscore-1.9.5

Security Fixes

  • Reject unsafe templateSettings.variable values that can execute arbitrary code.
    • This fixes a critical-severity code injection vulnerability (CVE-2021-23358).

1.9.4

Released Aug 20, 2026
CVE-2026-27601

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/underscore@1.9.2-underscore-1.9.4

Security Fixes

  • Replace recursive traversal in _.flatten() and _.isEqual() with explicit work stacks.
    • This fixes a high-severity Denial-of-Service (DoS) vulnerability (CVE-2026-27601).

1.9.3

Released Aug 19, 2026

Notes

  • This release contains no functional change from the OSS underscore v1.9.2.
  • This release mainlines OSS v1.9.2 into NES v1.9.3.
  • Full package name(s) and version(s):
    • @neverendingsupport/underscore@1.9.2-underscore-1.9.3

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.