CVE-2026-106550

A flaw was found in convict. An attacker capable of submitting untrusted configuration keys can bypass property filters within the config.set function to modify base JavaScript objects. This prototype pollution allows the attacker to alter fundamental language methods, causing persistent...

CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106550

Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service (DoS) via prototype pollution in the config.set() function. An attacker providing untrusted configuration keys can bypass existing filters (which only block constructor.prototype.* and __proto__.*) to write arbi...

CVE-2026-106550 CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106550 CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

EUVD-2026-93988

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

CVE-2026-106550 CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...

PT-2026-107250

Name of the Vulnerable Software and Affected Versions Node-convict versions 6.2.2 and later Description Incomplete prototype pollution protections in the config.set function allow an attacker who controls the configuration key to write arbitrary properties to constructor.. The walk function...

Malicious Package

Overview dagda-convict-nova-mongodb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview bellatrix-spawn-iota-convict is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview bellatrix-oberon-halley-convict is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +111 more potentially affected by CVE-2026-33864 via convict (>=6.0.0, <=6.2.4)

convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33864 Source advisory: OSV:GHSA-44FC-8FM5-Q62H...

Convict has Prototype Pollution via startsWith() function

Summary A prototype pollution vulnerability exists in the latest version of the convict npm package 6.2.4. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a...

GHSA-44FC-8FM5-Q62H Convict has Prototype Pollution via startsWith() function

Summary A prototype pollution vulnerability exists in the latest version of the convict npm package 6.2.4. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a...

@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +111 more potentially affected by CVE-2026-33863 via convict (>=6.0.0, <=6.2.4)

convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33863 Source advisory: OSV:GHSA-HF2R-9GF9-RWCH...

Prototype Pollution

Overview convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration...

@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +111 more potentially affected by CVE-2026-33863 via convict (>=6.0.0, <=6.2.4)

convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33863 Source advisory: SNYK:JS-CONVICT-15790594...

GHSA-HF2R-9GF9-RWCH Convict has prototype pollution via load(), loadFile(), and schema initialization

Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. config.load / config.loadFile — overlay recursively merges config data without checking for forbidden keys. Input containing proto or constructor.prototype e.g. from a JSON file causes the recursion to reach...

PT-2026-28540

Name of the Vulnerable Software and Affected Versions convict versions 6.2.4 Description A prototype pollution issue exists in the convict npm package. The issue stems from an incomplete fix that attempted to prevent prototype pollution by checking if user input begins with a prohibited key...

PT-2026-28539

Name of the Vulnerable Software and Affected Versions Convict affected versions not specified Description The software contains two prototype pollution flaws not addressed by prior fixes. The first flaw exists in the config.load and config.loadFile functions, where the overlay function recursivel...