The vulnerability CVE-2026-2950 affects Lodash functions _.unset and _.omit by allowing prototype pollution via array-wrapped path segments, bypassing security checks. This enables deletion of built-in JavaScript prototype properties, potentially leading to application instability or denial of service. The issue is present in Red Hat Developer Hub 1.10.0 and associated packages such as nodejs20 and yarnpkg. Red Hat has not provided an official patch or remediation that meets their standards for ease of use, applicability, and stability. The advisory references multiple related CVEs and CWE identifiers including CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes).

Exploitation of this vulnerability can result in modification or deletion of built-in JavaScript prototype properties, which may cause unexpected application behavior or denial of service. The integrity of application data or execution logic can be compromised. No confidential data impact is indicated. There are no known exploits in the wild at this time.

Currently, no official fix or patch is available from Red Hat that meets their criteria for deployment and stability. Users are advised to monitor Red Hat advisories for updates. Mitigation options are either unavailable or insufficient according to Red Hat Product Security. Consider upgrading to a supported product version with a fix once available or consult Red Hat support for guidance.