Inquiry about lodash dependency updates
Author: JappiPatelCreated Apr 22, 2026Updated Apr 22, 2026
Summary
We're downstream users of jsonwebtoken (via cf-nodejs-logging-support) and noticed PR #1022 addressing lodash vulnerabilities. Would appreciate any information about the status of this PR.
Impact
Our security scans flag [email protected] due to vulnerable lodash sub-packages including lodash.includes, lodash.isnumber, lodash.isboolean, etc.
CVEs:
- CVE-2026-4800 (CVSS 9.8) - Command Injection
- CVE-2019-10744 (CVSS 9.1) - Prototype Pollution
- CVE-2021-23337 (CVSS 7.2) - Command Injection
- CVE-2020-8203 (CVSS 7.4) - Prototype Pollution
Question
If possible, could you share:
- Any updates on PR #1022?
- Approximate timeline for a release?
- Whether there's anything blocking progress that we might help with?
We're available to help with testing if useful.
Context
- Dependency chain: Our app → [email protected] → [email protected]
References
- PR #1022
Source: auth0/node-jsonwebtoken