CVE-2026-33863: Convict has prototype pollution via load(), loadFile(), and schema initialization
Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. config.load() / config.loadFile() — overlay() recursively merges config data without checking for forbidden keys. Input containing proto or constructor.prototype (e.g. from a JSON file) causes the recursion to reach Object.prototype and write attacker-controlled values onto it. 2.
Published Mar 26, 2026
Affected packages
convict
- Ecosystem
- npm
- Affected
- <= 6.2.4
- Fixed in
- 6.2.5
- Check
npm ls convict
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Two unguarded prototype pollution paths exist, not covered by previous fixes:
config.load()/config.loadFile()—overlay()recursively merges config data without checking for forbidden keys. Input containing__proto__orconstructor.prototype(e.g. from a JSON file) causes the recursion to reachObject.prototypeand write attacker-controlled values onto it.- Schema initialization — passing a schema with
constructor.prototype.*keys toconvict({...})causes default-value propagation to write directly toObject.prototypeat startup.
Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.
Workarounds
Do not pass untrusted data to load(), loadFile(), or convict().
Resources
Prior advisory: GHSA-44fc-8fm5-q62h Related issue: https://github.com/mozilla/node-convict/issues/423
Credited to toufali, clouserw.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology