CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106550

Mozilla's Node-convict (version 6.2.2 and later ) is vulnerable to a Denial of Service (DoS) due to incomplete prototype-pollution protections in the config.set() function. An attacker capable of controlling the configuration key can inject arbitrary properties into constructor., which the walk()...

EUVD-2026-93988

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...