CVE-2025-13465

What it actually does

This vulnerability allows for prototype pollution in the Lodash library. An attacker can supply a specially crafted path string to the `_.unset` or `_.omit` functions, which causes the function to traverse up to the global `Object.prototype` and delete a specified property. This can lead to the removal of fundamental methods (e.g., `toString`, `hasOwnProperty`) from all objects within the application's runtime, causing widespread unexpected behavior, type errors, and application crashes, resulting in a denial of service.

Why it matters to the business

Exploitation of this flaw can lead to application-wide instability and crashes, resulting in a denial of service for users and business operations. Since Lodash is a foundational and extremely common library in web applications and backend services, the vulnerability poses a broad risk to service availability. The unpredictable application behavior resulting from the deletion of core object properties could also potentially lead to the bypass of security controls that rely on their existence.

How an attack unfolds

An attacker identifies an application endpoint that processes user-controlled input using a vulnerable version of Lodash's `_.unset` or `_.omit` functions. The attacker then crafts a malicious request, typically embedding a path string like `constructor.prototype.toString` within a JSON payload or a URL query parameter. When the backend application code receives this input and passes it to the vulnerable Lodash function, instead of operating on a local object, the function deletes the `toString` method from the global `Object.prototype`. As a result, any subsequent code that implicitly or explicitly calls this method on any object will fail, triggering uncaught exceptions that crash the Node.js process and take the service offline.

How to fix it

The definitive fix is to upgrade the Lodash library to the patched version 4.17.23 or a later version. Update your project's `package.json` to specify the safe version and run your package manager (e.g., `npm install` or `yarn upgrade`). If an immediate upgrade is not possible, implement strict input validation on any keys or paths passed to Lodash functions to reject strings containing `constructor`, `prototype`, or `__proto__`.

How to confirm the fix worked

To confirm remediation, inspect your project's dependency tree to ensure the resolved version of Lodash is 4.17.23 or higher. Use your package manager's commands, such as `npm ls lodash` or `yarn list --pattern lodash`, to verify the installed version. To test for the vulnerability, you can write a unit test that attempts to unset a property on the object prototype (e.g., `_.unset({}, 'constructor.prototype.toString')`) and then verify that the property still exists on a new object (`'toString' in {}`). In a vulnerable version, the property will be deleted.

Typical attack path

1. The attacker identifies an application using a vulnerable version of the Lodash library (4.0.0 through 4.17.22).
2. The attacker finds an input vector (such as a JSON API endpoint or URL query parameter) where user data is passed to the `_.unset` or `_.omit` functions.
3. The attacker sends a crafted payload containing a path that targets a property on the global object prototype, such as `constructor.prototype.toString`.
4. The server-side application processes the malicious payload with the vulnerable function.
5. The targeted property is deleted from the global prototype, corrupting the runtime environment for all objects.
6. The application becomes unstable and crashes when the deleted property is inevitably accessed, resulting in a denial of service.

How to detect it

Monitor application performance monitoring (APM) and logging systems for a sudden increase in application crashes, uncaught exceptions, or `TypeError` messages related to common methods (e.g., `... is not a function`). Inspect web server access logs, WAF logs, and application-level request logs for inbound HTTP requests containing suspicious strings in their body or query parameters. Look for patterns like `constructor.prototype` or `__proto__`, especially in keys or values associated with functions that might perform object manipulation.

• constructor.prototype
• __proto__

What your security team should do

• Immediately prioritize upgrading the Lodash library to version 4.17.23 or newer in all affected codebases.
• Utilize a Software Composition Analysis (SCA) tool to perform a comprehensive scan of all applications and dependencies to identify every instance of the vulnerable Lodash package.
• For systems where patching is delayed, advise development teams to implement input sanitization as a temporary mitigation to block malicious paths from reaching vulnerable functions.