Skip to content
OpenAdvisories

Package · npm

convict

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical —
    CVE-2026-33864

    Convict has Prototype Pollution via startsWith() function

    ### Summary A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still pos…

    convict npm
  • Critical —
    CVE-2026-33863

    Convict has prototype pollution via load(), loadFile(), and schema initialization

    ### Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.pr…

    convict npm