Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Node-convict by Mozilla
CVE-2026-106550 (GCVE-0-2026-106550)
Vulnerability from nvd – Published: 2026-10-06 20:09 – Updated: 2026-10-07 19:33
VLAI
EPSS
VEX
Title
CVE-2026-106550
Summary
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:05 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-400 - Uncontrolled Resource Consumption (‘Denial of Service’)
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Node-convict |
Affected:
6.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:05:14.037126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:05:19.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Node-convict",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "6.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mozilla\u0027s Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype\u2011pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.\u003ckey\u003e, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u2018Prototype Pollution\u2019)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption (\u2018Denial of Service\u2019)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:33:03.505Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/mozilla/node-convict"
},
{
"url": "https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106550",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106550"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106550",
"datePublished": "2026-10-06T20:09:55.919Z",
"dateReserved": "2026-10-06T20:07:46.075Z",
"dateUpdated": "2026-10-07T19:33:03.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106550 (GCVE-0-2026-106550)
Vulnerability from cvelistv5 – Published: 2026-10-06 20:09 – Updated: 2026-10-07 19:33
VLAI
EPSS
VEX
Title
CVE-2026-106550
Summary
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:05 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-400 - Uncontrolled Resource Consumption (‘Denial of Service’)
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Node-convict |
Affected:
6.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:05:14.037126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:05:19.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Node-convict",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "6.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mozilla\u0027s Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype\u2011pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.\u003ckey\u003e, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u2018Prototype Pollution\u2019)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption (\u2018Denial of Service\u2019)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:33:03.505Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/mozilla/node-convict"
},
{
"url": "https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106550",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106550"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106550",
"datePublished": "2026-10-06T20:09:55.919Z",
"dateReserved": "2026-10-06T20:07:46.075Z",
"dateUpdated": "2026-10-07T19:33:03.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}