CVE-2026-107353 in traverse
Summary
by MITRE • 10/07/2026
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The traverse library for Node.js contains a critical prototype pollution vulnerability affecting versions ranging from 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11. This flaw resides within the set() method, which is designed to assign values to nested properties of an object based on a provided path array. The vulnerability arises when the traversal logic encounters a primitive value during the resolution of the path segments. Instead of halting or throwing an error upon reaching a non-object type that cannot accept further property assignments in the traditional sense, the implementation incorrectly resolves subsequent path segments against the built-in prototype of that primitive type. This behavior allows an attacker to inject properties directly into String.prototype, Number.prototype, or Boolean.prototype by crafting specific input paths that traverse through existing object structures and then pivot onto these prototypes via their implicit wrapper objects.
From a technical perspective, this issue is classified under CWE-1325: Incorrect Check of Uniqueness of Array Indexes in Prototype Pollution, although it broadly falls under the more common category of CWE-915: Improper Modification of Object Attributes often associated with prototype pollution attacks. The core mechanism involves the JavaScript engine's automatic boxing of primitives when accessing properties. When traverse() processes a path such as ['name', '_proto_', 'polluted'], and the value at 'name' is a string, the library attempts to set 'polluted' on the String.prototype object rather than stopping because strings are immutable values in this context. This results in the permanent modification of the global prototype chain for that primitive type. Since all string operations in JavaScript ultimately rely on String.prototype, any subsequent code creating new strings or performing string methods will inherit these polluted properties unless explicitly overridden.
The operational impact of this vulnerability is severe and can lead to remote code execution or denial of service depending on how the affected application utilizes prototype pollution. By polluting global prototypes like Object.prototype indirectly through specific workarounds involving non-data path segments, proxies, or objects with dynamic toString methods, attackers can alter fundamental JavaScript behaviors. For instance, if an attacker manages to inject a malicious method into Function.prototype or modify Array.isArray via prototype manipulation, they could bypass security checks, escalate privileges within the application logic, or cause widespread instability by breaking standard library functions that rely on unmodified prototypes. In many modern web applications and server-side frameworks, such pollution can lead to authentication bypasses where identity checks fail because core comparison methods have been tampered with, leading to unauthorized access to sensitive resources.
Mitigation strategies primarily involve upgrading the traverse package to patched versions 0.3.10, 0.4.7, 0.5.3, or 0.6.12 and later, where this logic has been corrected to prevent traversal across primitive boundaries in a manner that affects prototypes. For applications unable to immediately upgrade, defensive coding practices should be implemented. Developers must strictly validate all input paths before passing them to the set() function, ensuring that no segment contains '_proto_', 'constructor', or 'prototype'. Additionally, using Object.freeze on critical objects can prevent property additions at runtime, although this does not protect against prototype pollution if the object itself is modified via its own prototype. It is also advisable to use JSON.parse with a reviver function to sanitize incoming data structures before they interact with vulnerable libraries, ensuring that no malicious path segments are introduced into the application state.
This vulnerability aligns with MITRE ATT&CK technique T1559: Inter-Process Communication, specifically in how JavaScript objects communicate and mutate shared states within the same execution context. It also relates to T1078: Valid Accounts if used for privilege escalation via authentication bypasses resulting from prototype pollution. Security teams should audit their dependency trees for any usage of traverse or similar deep-object manipulation libraries that do not explicitly guard against prototype chain traversal. Regular vulnerability scanning and static analysis tools configured to detect unsafe property assignments on dynamic paths are essential for maintaining the integrity of JavaScript-based applications susceptible to this class of memory corruption-like logic errors.