CVE-2026-33863
published 2026-03-26CVE-2026-33863: Convict has prototype pollution via load(), loadFile(), and schema initialization ### Impact Two unguarded prototype pollution paths exist, not covered by…
critical4.3
Convict has prototype pollution via load(), loadFile(), and schema initialization
### Impact
Two unguarded prototype pollution paths exist, not covered by previous fixes:
1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.
2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.
Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.
### Workarounds
Do not pass untrusted data to load(), loadFile(), or convict().
### Resources
Prior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h)
Related issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | convict | >= 0 < 6.2.5 | 6.2.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Convict has prototype pollution via load(), loadFile(), and schema initialization
osv·2026-03-26
CVE-2026-33863 [CRITICAL] Convict has prototype pollution via load(), loadFile(), and schema initialization
Convict has prototype pollution via load(), loadFile(), and schema initialization
### Impact
Two unguarded prototype pollution paths exist, not covered by previous fixes:
1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.
2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.
Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.
### Workarounds
Do
GHSA
Convict has prototype pollution via load(), loadFile(), and schema initialization
ghsa·2026-03-26
CVE-2026-33863 [CRITICAL] CWE-1321 Convict has prototype pollution via load(), loadFile(), and schema initialization
Convict has prototype pollution via load(), loadFile(), and schema initialization
### Impact
Two unguarded prototype pollution paths exist, not covered by previous fixes:
1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.
2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.
Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.
### Workarounds
Do
No detection rules found.
No public exploits indexed.
2026-03-26
Published