CVE-2026-27837 is a medium prototype pollution flaw (CVSS 6.3) in dottie, the npm package for nested object access. Versions 2.0.4 through 2.0.6 carry an incomplete fix for CVE-2023-26132. Upgrade to 2.0.7. The record does not mark it as exploited in the wild.
What's affected
dottie, the npm package, versions 2.0.4 through 2.0.6. The fixed version is 2.0.7.
Both dottie.set and dottie.transform are affected, per the record. Dottie often arrives as an indirect dependency of other libraries, so it may be in your tree even if you never installed it.
How to check if you're exposed
Find every copy of dottie in your dependency tree.
npm ls dottie
npm ls dottie --all
Read the version in each branch. Anything from 2.0.4 to 2.0.6 needs the update. In a monorepo, run the command in each package or read the lockfile.
Then search your code for calls to dottie.set and dottie.transform with keys or paths that come from users.
What to do now
- Upgrade dottie to 2.0.7 or later.
- If dottie is an indirect dependency, update the parent package that pulls it in, or use your package manager's override mechanism to force 2.0.7.
- Do not pass user supplied paths to dottie.set or dottie.transform without validating them.
- Rebuild and redeploy, then re-run npm ls to confirm no 2.0.4 to 2.0.6 copy remains.
- Paste your lockfile into the free scan at https://gold.safeguard.sh/scan to see all affected copies at once.
Why it matters
Prototype pollution lets an attacker alter the shared prototype that every JavaScript object inherits from. The earlier fix for CVE-2023-26132 added a guard that checked only the first segment of a dot-separated path, so putting the dangerous key at any later position got past it. Version 2.0.7 contains the updated fix. NVD classifies the flaw as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
The lesson is about incomplete fixes. A guard that checks one place in a path, rather than the whole path, tends to be bypassed. The medium score reflects a need for user interaction and limited impact, but the effect in your application depends on what reads the polluted properties.
Why indirect dependencies matter here
Dottie is a small utility that often arrives through another package. Teams find it only when a scanner lists it. That makes lockfile review the reliable way to find every copy.
When the parent package has not yet moved to 2.0.7, use your package manager's override or resolution feature to force the fixed version, then run your tests. Dottie's API is small, so a patch bump rarely breaks callers.
Record the override and remove it once the parent package updates, so it does not linger.
Add a test that calls the affected functions with a path that contains the dangerous key in a later position, and check it has no effect. That test protects you if a future refactor swaps the library.
Try it yourself
When a fixed version exists, the next question is which projects can take it today. This demo walks through that step.
Click through it at your own pace, or open it full screen.
Quick check
Is this a new bug or the old one?
It is a bypass of the earlier fix for CVE-2023-26132, so it affects versions that already had that fix.
Does the scan find indirect copies?
A dependency scan reads the full tree from your lockfile, including indirect packages.
Sources
Last reviewed: 19 October 2026.
