Skip to content
OpenAdvisories

Package · npm

convict

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Critical —
    CVE-2026-33864

    Convict has Prototype Pollution via startsWith() function

    ### Summary A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still pos…

    convict npm
  • Critical —
    CVE-2026-33863

    Convict has prototype pollution via load(), loadFile(), and schema initialization

    ### Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.pr…

    convict npm
  • High 8.4
    CVE-2023-0163

    Prototype Pollution in convict

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have …

    Mozilla Convict convict npm
  • High 7.5
    CVE-2022-21190

    Prototype Pollution

    This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies o…

    convict npm
  • High 7.5
    CVE-2022-22143

    Prototype Pollution

    The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-J…

    convict npm