CVE-2026-27837: dottie Prototype Pollution Bypass Vulnerability
Summary
CVE-2026-27837: dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform(). Affects dottie versions >= 2.0.4, < 2.0.7. Fixed in 2.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dottie is a JavaScript library used for accessing and manipulating nested object properties using dot-separated paths. It simplifies the process of setting and transforming properties within complex objects. However, versions 2.0.4 to 2.0.6 of dottie are vulnerable to a prototype pollution bypass, which can lead to unauthorized access and manipulation of object properties.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2023-26132, where the prototype pollution guard only checks the first segment of a dot-separated path. This allows attackers to bypass the guard by placing 'proto' at any position other than the first. As a result, properties can be injected into an object's prototype chain, leading to potential authorization bypass and other security issues. The injected properties are not detectable using standard methods like hasOwnProperty() or Object.keys(), making them particularly dangerous.
How To Fix
Minimum fixed version
2.0.7
This is the first release that contains the fix.
npm install dottie@2.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using dottie's set() and transform() methods with user-controlled input that may contain dot-separated paths. If you must use these methods, ensure that input is sanitized and validated to prevent prototype pollution.
Conclusion
The dottie library has a vulnerability that allows for prototype pollution bypass, which can lead to serious security issues such as unauthorized access. It is crucial to update to version 2.0.7 or later to mitigate this risk. Additionally, employing input validation and using tools like Vulert can help monitor and protect against such vulnerabilities.
See every vulnerability recorded for dottie →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to inject properties into an object's prototype chain, potentially leading to unauthorized access and manipulation of object properties.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your package-lock.json file.
The primary risk is authorization bypass, where an attacker can inject properties like isAdmin into objects used for access control, making it difficult to detect unauthorized access.
While this specific vulnerability affects dottie versions 2.0.4 to 2.0.6, similar prototype pollution issues can exist in other libraries if they do not properly validate input paths.
If you cannot update dottie right away, implement input validation and sanitization to mitigate the risk of prototype pollution until you can upgrade to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for dottie.
