debian/node-traverse vulnerabilities

Latest debian/node-traverse CVEs

Newest publication first

1. CVE-2026-107353 traverse: set() can write to built-in prototypes via an untrusted path

   Published 2026-10-07

   Medium·CVSS 6.9

   traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototy...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.