CVERadar
CRITICAL · CVSS 3.1 9.1Public PoCEPSS 5.01% (p92)Threat level 51

CVE-2019-10744: CVE-2019-10744: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function …

lodash · lodash · NVD published 2019-07-26 · posted 2026-05-11 · last modified 2026-06-17

CVE-2019-10744 at a glance

CVE-2019-10744 is a critical-severity Prototype Pollution vulnerability in Lodash, with a CVSS 3.1 base score of 9.1. NVD published it on 2019-07-26 and classifies the weakness as CWE-1321. Public exploit code: 3 public GitHub proof-of-concept repositories from 3 accounts, with the earliest exploit evidence dated 2026-05-11. FIRST EPSS puts the probability of exploitation activity in the next 30 days at 5.01% (percentile 92.2, scored 2026-11-06). NVD configuration data lists a fixed release for 22 products, for example lodash lodash 4.17.12. Its CVERadar threat level is 51/100.

What it is

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

WeaknessCWE-1321 definition
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (source: NIST NVD)
ATT&CK tacticsn/a

Exploitation evidence

First exploit evidence seen: 2026-05-11 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

GitHub proof-of-concept repositories

3 public repositories from 3 accounts, first seen 2026-05-11. Most starred: mlbrilliance/aurora-demo-lockfile (0 stars), view the mlbrilliance/aurora-demo-lockfile repository on GitHub.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: nomi-sec/PoC-in-GitHub.

Patches, mitigations and detection

Fixed versions

  • lodash lodash: upgrade to 4.17.12 or later
  • f5 big-ip access policy manager: upgrade to 12.1.5.2 or later (affected from 12.1.0)
  • f5 big-ip access policy manager: upgrade to 13.1.3.4 or later (affected from 13.1.0)
  • f5 big-ip access policy manager: upgrade to 14.1.2.5 or later (affected from 14.1.0)
  • f5 big-ip access policy manager: upgrade to 15.0.1.4 or later (affected from 15.0.0)
  • f5 big-ip access policy manager: upgrade to 15.1.0.2 or later (affected from 15.1.0)
  • f5 big-ip advanced firewall manager: upgrade to 12.1.5.2 or later (affected from 12.1.0)
  • f5 big-ip advanced firewall manager: upgrade to 13.1.3.4 or later (affected from 13.1.0)
  • f5 big-ip advanced firewall manager: upgrade to 14.1.2.5 or later (affected from 14.1.0)
  • f5 big-ip advanced firewall manager: upgrade to 15.0.1.4 or later (affected from 15.0.0)
  • f5 big-ip advanced firewall manager: upgrade to 15.1.0.2 or later (affected from 15.1.0)
  • f5 big-ip analytics: upgrade to 15.0.1.3 or later (affected from 15.0.0)
  • f5 big-ip analytics: upgrade to 15.1.0.2 or later (affected from 15.1.0)
  • f5 big-ip application acceleration manager: upgrade to 12.1.5.2 or later (affected from 12.1.0)
  • f5 big-ip application acceleration manager: upgrade to 13.1.3.4 or later (affected from 13.1.0)
  • f5 big-ip application acceleration manager: upgrade to 14.1.2.5 or later (affected from 14.1.0)
  • f5 big-ip application acceleration manager: upgrade to 15.0.1.4 or later (affected from 15.0.0)
  • f5 big-ip application acceleration manager: upgrade to 15.1.0.2 or later (affected from 15.1.0)
  • f5 big-ip application security manager: upgrade to 12.1.5.2 or later (affected from 12.1.0)
  • f5 big-ip application security manager: upgrade to 13.1.3.4 or later (affected from 13.1.0)
  • f5 big-ip application security manager: upgrade to 14.1.2.5 or later (affected from 14.1.0)
  • f5 big-ip application security manager: upgrade to 15.0.1.4 or later (affected from 15.0.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

Detection Generic guidance

    Response checklist Generic guidance

    1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
    2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
    3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
    4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

    Sources