CVE-2020-28500: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumb

This week

MEDIUM 5.3REMOTEUPGRADEDOWNGRADEDOWNGRADE

CVE-2020-28500 is a medium-severity flaw (CVSS 5.3) affecting lodash, banking corporate lending process management, banking credit facilities process management. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Why this priority

EPSS top 6%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	7.3% (top 6%)
CISA exploited list	No
Published	2021-02-15
Last modified	2026-10-08

Publisher (CNA): Snyk · Vendor: lodash · oracle

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-02-15 11:15 UTCPublished CVE record published
2026-10-08 22:16 UTCUpdated Record last modified

lodash lodash UPGRADE

Affected: < 4.17.21

Fixed in: 4.17.21

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls lodash

2. UPGRADE to 4.17.21

npm install lodash@">=4.17.21"

oracle banking corporate lending process management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-corporate-lending-process-management || rpm -q banking-corporate-lending-process-management || banking-corporate-lending-process-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-corporate-lending-process-management sudo apt install banking-corporate-lending-process-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-corporate-lending-process-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-corporate-lending-process-management sudo dnf downgrade banking-corporate-lending-process-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-corporate-lending-process-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking credit facilities process management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-credit-facilities-process-management || rpm -q banking-credit-facilities-process-management || banking-credit-facilities-process-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-credit-facilities-process-management sudo apt install banking-credit-facilities-process-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-credit-facilities-process-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-credit-facilities-process-management sudo dnf downgrade banking-credit-facilities-process-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-credit-facilities-process-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking extensibility workbench DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-extensibility-workbench || rpm -q banking-extensibility-workbench || banking-extensibility-workbench --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-extensibility-workbench sudo apt install banking-extensibility-workbench=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-extensibility-workbench

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-extensibility-workbench sudo dnf downgrade banking-extensibility-workbench-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-extensibility-workbench

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking supply chain finance DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-supply-chain-finance || rpm -q banking-supply-chain-finance || banking-supply-chain-finance --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-supply-chain-finance sudo apt install banking-supply-chain-finance=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-supply-chain-finance

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-supply-chain-finance sudo dnf downgrade banking-supply-chain-finance-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-supply-chain-finance

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking trade finance process management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-trade-finance-process-management || rpm -q banking-trade-finance-process-management || banking-trade-finance-process-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-trade-finance-process-management sudo apt install banking-trade-finance-process-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-trade-finance-process-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-trade-finance-process-management sudo dnf downgrade banking-trade-finance-process-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-trade-finance-process-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-28500?

lodash: upgrade to 4.17.21; banking corporate lending process management: downgrade or apply the listed mitigation; banking credit facilities process management: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-28500 being exploited?

CVE-2020-28500 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-28500 affect?

CVE-2020-28500 affects lodash, banking corporate lending process management, banking credit facilities process management. Severity is medium (CVSS 5.3). Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

How urgent is CVE-2020-28500?

Priority 52/100. EPSS top 6%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

Lodash vulnerabilities

Related CVEs

CVE-2025-13465 MEDIUM 5.3 UPGRADE The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
CVE-2021-23337 HIGH 7.2 UPGRADE DOWNGRADE Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-8203 HIGH 7.4 UPGRADE DOWNGRADE Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2019-10744 CRITICAL 9.1 UPGRADE MITIGATE Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution
CVE-2019-1010266 MEDIUM 6.5 UPGRADE lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption

References

← Back to latest CVEs