Security Impact: Multiple Critical CVEs in Lodash Dependencies

Thank you @gameroman for this PR! I want to emphasize the urgent security need for this change based on recent vulnerability scans.

Current State (jsonwebtoken@9.0.3)

The lodash sub-packages currently pulled in by jsonwebtoken have 10+ known CVEs, including:

Most Critical Issues

CVE-2026-4800 (CVSS 9.8 - Critical):

• Command Injection in _.template() - bypass of CVE-2021-23337 fix
• Arbitrary code execution when processing untrusted template input
• Affects lodash versions ≤ 4.17.23 (all sub-packages in jsonwebtoken use older versions)

CVE-2019-10744 (CVSS 9.1 - Critical):

• Prototype Pollution vulnerability
• Allows modification of Object.prototype affecting all objects

Real-World Impact

These vulnerabilities are actively flagged by:

• SAP Security Vulnerability Management (SVM)
• Black Duck SCA scans
• Snyk, Dependabot, and other security tools

Organizations using jsonwebtoken are receiving daily security alerts that they cannot resolve without this PR being merged.

Request

Could you please prioritize reviewing and merging this PR? The security impact is significant, and this affects thousands of downstream projects. All tests pass, and the changes appear straightforward.

References:

• CVE-2026-4800: https://nvd.nist.gov/vuln/detail/CVE-2026-4800
• CVE-2019-10744: https://nvd.nist.gov/vuln/detail/CVE-2019-10744
• Original issue get rif of lodash dependency #991

Thank you for maintaining this package! 🙏

Hi @CharlesRea let me know if you are interested in this PR, thanks

Hello @gameroman , do you have any update on this? Thanks in advance !!

Need this