Skip to content
OpenAdvisories

Package · Debian

node-dottie

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-27837

    Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

    Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated pa…

    mickhansen dottie.js node-dottie dottie Debian Ubuntu npm