Dottie provides nested object access and manipulation in JavaScript.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing at any position other than the first. Both and are affected. Version 2.0.7 contains an upd

2. Jun 17, 2026 · NIST NVD

   Updated

   Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing at any position other than the first. Both and are affected. Version 2.0.7 contains an upd

Affected

• cpe dottie project/dottieversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27837

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27837

  Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit only validates the first segment of a dot-separated path, allowing an attac

  nvd.nist.gov

References

• Not Applicable · github.com
• Patch · github.com
• Exploit · github.com