p PatchFirst

CVE-2026-27837

CVE-2026-27837 · Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.

CVSS 6.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • dottie.js

    Versions
    • >= 2.0.4, < 2.0.7: Affected

    No fix published

  • node-dottie Debian:12

    Versions
    • 2.0.2-4
    • 2.0.2-4+deb12u1
    • 2.0.6+~2.0.5-1
    • 2.0.6+~2.0.5-2
    • 2.0.7+~2.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Debian:13

    Versions
    • 2.0.6+~2.0.5-2
    • 2.0.7+~2.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Debian:14

    Versions
    • 2.0.6+~2.0.5-2
    Affected ranges
    • ECOSYSTEM: < 2.0.7+~2.0.7-1

    Update to 2.0.7+~2.0.7-1

  • dottie npm

    Affected ranges
    • SEMVER: ≥ 2.0.4, < 2.0.7

    Update to 2.0.7

  • node-dottie Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.2-1
    • 2.0.2-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.2-1
    • 2.0.2-3
    • 2.0.2-4
    • 2.0.2-4ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Ubuntu:24.04:LTS

    Versions
    • 2.0.6+~2.0.5-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Ubuntu:25.10

    Versions
    • 2.0.6+~2.0.5-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Ubuntu:26.10

    Versions
    • 2.0.7+~2.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-dottie Ubuntu:26.04:LTS

    Versions
    • 2.0.6+~2.0.5-2
    • 2.0.7+~2.0.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →