6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27837

CVE-2026-27837: Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing __proto__ at any position other than the first. Both dottie.set() and dottie.transform() are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27837

CVE-2026-27837:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
dottie	npm	>= 2.0.4, <= 2.0.6	2.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of a previous prototype pollution fix (CVE-2023-26132) in the dottie.js library. The initial fix was incomplete, as it only prevented prototype pollution when __proto__ was the first segment in a dot-separated path. This allowed attackers to circumvent the protection by placing __proto__, constructor, or prototype in subsequent path segments.

The fixing commit, 7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14, reveals the exact locations of the vulnerability. The patch modifies both the Dottie.set and Dottie.transform functions. In both functions, a simple check (if (pieces[0] === '__proto__')) was replaced with a more robust validation that inspects every segment of the path (pieces.some(...)) for a list of dangerous keys (__proto__, constructor, prototype).

The removed lines are direct evidence of the flawed logic. The set function, which sets a value on a nested path, and the transform function, which converts a flat object with dot-notation keys into a nested object, were both susceptible. Exploitation would involve calling either of these functions with a specially crafted path string, leading to the modification of an object's prototype chain.

Vulnerable functions

set

dottie.js

The function was vulnerable to prototype pollution because it only checked if the first segment of the input `path` was `__proto__`. An attacker could bypass this check by providing a path where `__proto__` or another dangerous key like `constructor` or `prototype` appeared in a later position (e.g., 'a.__proto__.polluted'). The function would then incorrectly modify the prototype of an object, leading to potential authorization bypasses or denial of service.

transform

dottie.js

The function was vulnerable to prototype pollution while processing object keys. It only checked if the first segment of a key was `__proto__`. An attacker could bypass this check by crafting a key where `__proto__` or another dangerous key like `constructor` or `prototype` appeared in a later position (e.g., 'user.__proto__.isAdmin'). The function would then incorrectly modify the prototype of the resulting transformed object, leading to potential authorization bypasses or denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.