Prototype Pollution Vulnerability in Traverse by Node.js
CVE-2026-107353
6.9MEDIUM
What is CVE-2026-107353?
The traverse library for Node.js contains a vulnerability that allows prototype pollution through the 'set()' function in various versions. By passing a crafted path that crosses a primitive value, an attacker can manipulate fundamental object prototypes like String.prototype, Number.prototype, and Boolean.prototype. This manipulation can lead to unexpected behaviors in applications using traverse. The issue is resolved in subsequent versions: 0.3.10, 0.4.7, 0.5.3, and 0.6.12, which include patches to prevent such exploitation.
Affected Version(s)
traverse 0.3.6 < 0.3.10
traverse 0.4.0 < 0.4.7
traverse 0.5.0 < 0.5.3