CVE-2025-13465: Lodash Prototype Pollution Vulnerability

CVE-2025-13465 Overview

CVE-2025-13465 is a prototype pollution vulnerability affecting Lodash versions 4.0.0 through 4.17.22. The vulnerability exists in the _.unset and _.omit functions, where an attacker can pass crafted paths that cause Lodash to delete methods from global prototypes. While this issue permits deletion of properties, it does not allow overwriting their original behavior.

Prototype pollution vulnerabilities in JavaScript libraries like Lodash can have far-reaching consequences in both client-side and server-side applications, potentially affecting application stability and enabling denial of service conditions.

Critical Impact

Attackers can manipulate JavaScript object prototypes by deleting properties through crafted input paths, potentially disrupting application functionality across all objects that inherit from the affected prototype.

Affected Products

• Lodash versions 4.0.0 through 4.17.22
• Applications using vulnerable _.unset function
• Applications using vulnerable _.omit function

Discovery Timeline

• 2026-01-21 - CVE CVE-2025-13465 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-13465

Vulnerability Analysis

This prototype pollution vulnerability (CWE-1321) allows attackers to manipulate the behavior of JavaScript applications by deleting properties from global object prototypes. The _.unset and _.omit functions in Lodash are designed to remove properties from objects, but insufficient validation of the property path allows attackers to traverse beyond the intended object scope and delete properties from Object.prototype or other built-in prototypes.

When an attacker provides a specially crafted path containing prototype chain references (such as __proto__ or constructor.prototype), the vulnerable functions follow these paths and delete properties from the global prototype chain. This can cause unpredictable behavior in applications that rely on the presence of standard prototype methods.

The vulnerability is exploitable over a network vector with low attack complexity, requiring no privileges or user interaction. The impact primarily affects system integrity and availability, with potential downstream effects on applications sharing the same JavaScript runtime.

Root Cause

The root cause of this vulnerability is improper input validation in the path parsing logic of the _.unset and _.omit functions. These functions fail to properly sanitize or restrict property paths that reference prototype chain properties like __proto__, constructor, or prototype. This allows path traversal beyond the target object into the global prototype chain.

Attack Vector

The attack vector is network-based, where an attacker can supply malicious input containing crafted property paths to any application endpoint that passes user-controlled data to the _.unset or _.omit functions. Common attack scenarios include:

1. API endpoints that accept JSON objects with user-specified property paths for deletion
2. Configuration management interfaces that use Lodash to manipulate nested object properties
3. Data transformation pipelines where property names are derived from user input

The vulnerability manifests when crafted paths containing prototype references are processed by the vulnerable functions. An attacker might submit a path such as __proto__.toString or constructor.prototype.hasOwnProperty to delete critical prototype methods.

For detailed technical information and proof-of-concept examples, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-13465

Indicators of Compromise

• Unexpected JavaScript errors related to missing prototype methods (e.g., TypeError: x.toString is not a function)
• Application logs showing unusual property paths containing __proto__, constructor, or prototype
• Runtime exceptions in previously stable code paths that rely on inherited object methods
• Anomalous API requests with deeply nested object paths or prototype chain references

Detection Strategies

• Implement static code analysis to identify usage of _.unset and _.omit with user-controlled input
• Deploy runtime application monitoring to detect prototype pollution attempts in real-time
• Use Software Composition Analysis (SCA) tools to identify vulnerable Lodash versions in your dependency tree
• Audit application logs for suspicious property path patterns matching prototype pollution attempts

Monitoring Recommendations

• Configure alerts for JavaScript runtime errors that may indicate deleted prototype methods
• Monitor application performance metrics for sudden degradation that could indicate successful exploitation
• Implement request logging that captures the full payload structure for endpoints using Lodash object manipulation functions
• Enable dependency vulnerability scanning in CI/CD pipelines to detect vulnerable Lodash versions before deployment

How to Mitigate CVE-2025-13465

Immediate Actions Required

• Upgrade Lodash to version 4.17.23 or later immediately
• Audit all code paths that use _.unset or _.omit with user-controlled input
• Implement input validation to reject property paths containing __proto__, constructor, or prototype
• Consider using Object.freeze(Object.prototype) as a defense-in-depth measure in Node.js environments

Patch Information

The Lodash maintainers have addressed this vulnerability in version 4.17.23. Organizations should upgrade to this version or later to remediate the vulnerability. The patch adds proper validation to prevent prototype chain traversal in the affected functions.

For detailed patch information and additional context, see the GitHub Security Advisory.

Workarounds

• Implement a wrapper function around _.unset and _.omit that validates paths before passing them to the underlying Lodash functions
• Use allowlisting to restrict acceptable property paths to known-safe values
• Replace vulnerable function usage with native JavaScript alternatives where possible (e.g., destructuring with rest syntax for _.omit)
• Deploy Web Application Firewall (WAF) rules to block requests containing prototype pollution patterns

# Configuration example
# Update Lodash in your project using npm
npm update lodash --save

# Verify the installed version
npm list lodash

# Alternative: Install specific patched version
npm install lodash@4.17.23 --save