CVE-2026-33863
1 advisory.
npm/convict CVE-2026-33863: critical
Convict has prototype pollution via load(), loadFile(), and schema initialization
Action: Upgrade convict to 6.2.5 or later.
npm i convict@6.2.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.2.5 | - |
Fixed versions
| 6.2.5 |
Sources
- osv: GHSA-hf2r-9gf9-rwch
- https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h
- https://github.com/mozilla/node-convict/security/advisories/GHSA-hf2r-9gf9-rwch
- https://github.com/mozilla/node-convict/issues/423
- https://github.com/mozilla/node-convict
CVE-2026-33863 · published · modified · JSON