CVE-2026-106550: High severity npm/convict vulnerability
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype. and proto.. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Restart the affected process after exploitation, as persistent process-wide failures require a restart.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed only if they have an endpoint or other input path that forwards attacker-controlled configuration keys into config.set(). The affected package is npm/convict version 6.2.2 and later.
What does successful exploitation do to a running application?
An attacker can add properties to the global Object function through constructor.<key>. This can overwrite core JavaScript methods, such as Object.assign, causing persistent process-wide failures until the process is restarted.
How can teams check whether their application has an exploitable path?
Review calls to config.set() and determine whether the configuration key can be influenced by an external requester or other untrusted input. Inputs limited to constructor.prototype.* and __proto__.* are not the only concern, because constructor.<key> can bypass those existing filters.