CVE-2026-27837
1 advisory.
npm/dottie CVE-2026-27837: medium 6.3, EPSS 0.55%
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()
Action: Upgrade dottie to 2.0.7 or later.
npm i dottie@2.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.4 | 2.0.7 | - |
Fixed versions
| 2.0.7 |
Sources
- osv: GHSA-r5mx-6wc6-7h9w
- https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27837
- https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
- https://github.com/advisories/GHSA-4gxf-g5gf-22h4
- https://github.com/mickhansen/dottie.js
CVE-2026-27837 · published · modified · JSON