underscore (npm)
JavaScript's utility _ belt
Advisories
4
Latest version
1.13.8
Released Feb 19, 2026
License
MIT
OpenSSF Scorecard
6.1 / 10
How to fix
Upgrading to 1.13.8 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install underscore@1.13.8yarn
yarn add underscore@1.13.8pnpm
pnpm add underscore@1.13.8Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qpx9-hpmf-5gmw Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack |
High EPSS 1.06% |
<= 1.13.7 | No fix yet |
| GHSA-qpx9-hpmf-5gmw Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack |
High EPSS 1.06% |
< 1.13.8 | 1.13.8 |
| GHSA-cf4h-3jhx-xvhq Arbitrary Code Execution in underscore |
Critical EPSS 4.20% |
>= 1.3.2, < 1.12.1 | 1.12.1 |
| GHSA-cf4h-3jhx-xvhq Arbitrary Code Execution in underscore |
Critical EPSS 4.20% |
>= 1.3.2, < 1.12.1 | 1.12.1 |
Source: git://github.com/jashkenas/underscore.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor