Skip to content
Log inStart free trial

dot-prop (npm)

Get, set, or delete a property from a nested object using a dot path

Advisories
2
Latest version
10.2.0
Released Jul 21, 2026
License
MIT
OpenSSF Scorecard
3.8 / 10

How to fix

Upgrading to 5.1.1 or later clears every advisory below that has a fix.

Upgrade commands
npm
npm install dot-prop@10.2.0
yarn
yarn add dot-prop@10.2.0
pnpm
pnpm add dot-prop@10.2.0

Known vulnerabilities

AdvisorySeverityAffectedFixed in
GHSA-ff7x-qrg7-qggm
dot-prop Prototype Pollution vulnerability
 High
EPSS 3.08%
< 4.2.1
4.2.1
GHSA-ff7x-qrg7-qggm
dot-prop Prototype Pollution vulnerability
 High
EPSS 3.08%
>= 5.0.0, < 5.1.1
5.1.1

Source: git+https://github.com/sindresorhus/dot-prop.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor