PT-2026-28540 · Npm · Convict

Published 2026-03-26 · Updated 2026-03-30 · CVE-2026-33864

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions convict versions 6.2.4

Description A prototype pollution issue exists in the convict npm package. The issue stems from an incomplete fix that attempted to prevent prototype pollution by checking if user input begins with a prohibited key. However, it is still possible to pollute Object.prototype using a crafted input leveraging String.prototype. The vulnerability is located in the startsWith() function used to validate user-provided input. A proof of concept demonstrates that by redefining String.prototype.startsWith to always return false, the check is bypassed, allowing for prototype pollution. This can potentially lead to authentication bypass, denial of service, or remote code execution if a polluted property is passed to vulnerable functions.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-33864

GHSA-44FC-8FM5-Q62H

Affected Products

Convict

References · 6

• https://osv.dev/vulnerability/GHSA-44fc-8fm5-q62h · Vendor Advisory
• https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js · Note
• https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h · Note
• https://github.com/mozilla/node-convict · Note
• https://twitter.com/the_yellow_fall/status/2038619504469512618 · Twitter Post
• https://twitter.com/pulsepatchio/status/2037544796898603455 · Twitter Post