CVE-2026-33864
1 advisory.
npm/convict CVE-2026-33864: critical
Convict has Prototype Pollution via startsWith() function
Action: Upgrade convict to 6.2.5 or later.
npm i convict@6.2.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.2.5 | - |
Fixed versions
| 6.2.5 |
Sources
- osv: GHSA-44fc-8fm5-q62h
- https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h
- https://github.com/mozilla/node-convict
- https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js
CVE-2026-33864 · published · modified · JSON