debian/node-dottie vulnerabilities

Latest debian/node-dottie CVEs

Newest publication first

1. CVE-2026-27837 Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

   Published 2026-02-26

   Critical·CVSS 9.8 EPSS 0.36%

   Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacke...

2. CVE-2023-26132 dottie vulnerable to Prototype Pollution

   Published 2023-06-10

   High·CVSS 7.5 EPSS 1.1%

   Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.