Prototype Pollution in node-convict leading to TypeError/DoS (CVE-2026-106550)

Vulnerability Overview CVE-2026-106550: In version 6.2.5, overwrites , causing a to be thrown when this method is invoked within the current JavaScript context. Affected Versions Affected Versions: 6.2.2 and higher (although the structured version field name only displays 6.2.2). Unaffected Versions: npm released versions 6.2.2, 6.2.3, 6.2.4, and 6.2.5; version 6.2.1 was not reproducible. Exploitation Conditions: Dependent on the application passing an attacker-controlled key to . Root Cause In the 6.2.5 source code, rejects and but accepts . The function tests every path starting with , including inherited keys. In a fresh configuration, originates from and resolves to the built-in function. The assignment replaces . Reproduction Steps Reproduction performed using Node.js 26.7.0 and convict 6.2.5. Commands utilize a temporary directory and a separate Node.js process. Node.js Output: Impact Status Configuration or feature flag endpoints that forward client-supplied keys to may expose this vector. An accepted update may cause subsequent requests to fail in the same JavaScript context, even if those requests do not modify the configuration. The mutation persists until the method is restored or the worker is restarted. Applications can implement key allowlisting prior to calling . Public announcements indicate that as of October 7, 2026, no patched versions were available. Disclosure The issue was reported privately. CERT/CC coordinated the case and issued the CVE on October 6, 2026. Thanks to CERT/CC for their assistance. References CVE Program record NIST NVD entry GitHub Advisory Database entry node-convict 6.2.5 source

Goal Reached Thanks to every supporter — we hit 100%!

Prototype Pollution in node-convict leading to TypeError/DoS (CVE-2026-106550)

More from this source