GHSA-qpx9-hpmf-5gmw
Medium · 5.9CVSS
5.9
EPSS
—
Published
Mar 3, 2026
CISA due date
—
The record
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | underscore | 0 | 1.13.8 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r13 |
| Chainguard | prism | 0 | 5.14.3-r9 |
| Chainguard | renovate | 0 | 43.55.6-r0 |
| Chainguard | vitess-22 | 0 | 22.0.4-r5 |
| Chainguard | vitess-23 | 0 | 23.0.3-r6 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r13 |
| Wolfi | prism | 0 | 5.14.3-r9 |
| Wolfi | renovate | 0 | 43.55.6-r0 |
| Wolfi | vitess-22 | 0 | 22.0.4-r5 |
| Wolfi | vitess-23 | 0 | 23.0.3-r6 |
Related vulnerabilities
- CVE-2026-27601 Underscore.js is a utility-belt library for JavaScript. Same vulnerability
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects kubeflow-centraldashboard
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects kubeflow-centraldashboard
- CVE-2026-33896 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects kubeflow-centraldashboard
- CVE-2026-33894 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects kubeflow-centraldashboard
- CVE-2026-33891 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects kubeflow-centraldashboard
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects kubeflow-centraldashboard
- GHSA-2328-f5f3-gj25 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280… Also affects kubeflow-centraldashboard