OSV lodash Advisory Snapshot

GHSA ReDoS in lodash is an OSV row. That is not a repair of your Actor.

OSV.dev advisories for npm lodash. Same class as GitHub Advisories — Try package is lodash. $0.01.

Last run

Live row(s). First row: GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash

{
  "title": "GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash",
  "entityName": "GHSA-29mw-wpgm-hmr9",
  "listingName": "GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash",
  "productName": "GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash",
  "sourceUrl": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
  "sourceName": "OSV.dev lodash advisories — not a repair bench"
}

Run it

{
  "searchKeywords": [
    "lodash"
  ],
  "sourceMode": "startUrls",
  "outputMode": "buyer-ready-records",
  "maxItems": 10,
  "startUrls": [
    {
      "url": "https://api.osv.dev/v1/query"
    }
  ]
}

What lands in the dataset

• OSV.dev v1/query
• vuln id + summary
• osv.dev URL

Use it when

Point at another npm package in production. Try is lodash.

AppSec people who already query osv.dev.

Price

$0.01 / advisory — about $0.10 for a 10-row Try.

Schedule it. A one-off click is not Store revenue.

What you should know

• Overlaps GitHub Advisory Snapshot.
• Does not patch lodash for you.

FAQ

Is the last-run a fixture? No. If the dataset is empty, the public source failed — we do not invent a row.

Same as GitHub Advisories? Different API. Try package is lodash. Pick one.