While scanning published npm packages for third-party code that audits miss, we found that [email protected] (npm latest) depends on lodash.truncate ^4.4.2 (dist/src/truncateTableData.js:7). lodash.truncate 4.4.2, its latest release (2016), contains lodash's toNumber from before the CVE-2020-28500 fix:

• CVE-2020-28500 (GHSA-29mw-wpgm-hmr9): ReDoS in toNumber, trim and trimEnd through /^\s+|\s+$/g (fixed in lodash 4.17.21, which replaced it with baseTrim)

In lodash.truncate the regex is var reTrim = /^\s+|\s+$/g; (index.js:24), used by toNumber (:507). truncate() reaches it through toInteger(options.length) (:582).

The advisory lists lodash, lodash-es, lodash-rails, lodash.trim and lodash.trimend, but not lodash.truncate, and no fixed lodash.truncate release exists. So npm audit and SCA tools report nothing for table or for the bundles that inline it (for example aws-cdk through @aws-cdk/cloudformation-diff). #136 moved from lodash to per-method packages to avoid CVE reports, and #186 later asked to move back. With per-method packages, this code stays in the tree without any advisory pointing at it.

We did not find a way for it to lead to an exploit through table: truncateString passes the column's numeric truncate width as length, and toNumber returns early for numbers. Because the code ships where dependency audits cannot see it, it is easy to miss. We would suggest updating when convenient.

Suggested fix: replace lodash.truncate with a small local truncate (table only needs length and the … omission, and truncateString was just reworked for #220 and #113), or with lodash/truncate from lodash >= 4.17.21.

Reproduction

Checked against the published tarballs on 2026-11-04 (npm latest):

npm pack [email protected] [email protected]
mkdir t lt
tar xzf table-6.10.0.tgz -C t; tar xzf lodash.truncate-4.4.2.tgz -C lt
node -p "require('./t/package/package.json').dependencies['lodash.truncate']"
grep -n 'require("lodash.truncate")' t/package/dist/src/truncateTableData.js
grep -n "var reTrim\|value.replace(reTrim\|toInteger(options.length)" lt/package/index.js

Output:

^4.4.2
7:const lodash_truncate_1 = __importDefault(require("lodash.truncate"));
24:var reTrim = /^\s+|\s+$/g;
507:  value = value.replace(reTrim, '');
582:    length = 'length' in options ? toInteger(options.length) : length;