CVE-2026-107701: Ntharim Dot-Access

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

Affected products

• Ntharim Dot-Access: up to and including 1.0.0

Published 2026-10-08. Last modified 2026-10-08.