Skip to content
Fencer Vulns
critical —

CVE-2026-33863 json

Convict has prototype pollution via load(), loadFile(), and schema initialization

published 2026-03-26 7 mo ago modified 2026-03-26 7 mo ago also GHSA-hf2r-9gf9-rwch

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

### Impact Two unguarded prototype pollution paths exist, not covered by previous fixes:

1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it. 2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.

Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.

### Workarounds Do not pass untrusted data to load(), loadFile(), or convict().

### Resources Prior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h) Related issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)

Patch / fix

  • npm convict 6.2.5

Affected packages

ecosystem package affected fixed in
npm convict
<6.2.5
6.2.5

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.