{"action":"Upgrade convict to 6.2.5 or later.","affected":[{"fixed":"6.2.5","introduced":"0"}],"component":"convict","cve_ids":["CVE-2026-33864"],"ecosystem":"npm","exploited":false,"fixed_versions":["6.2.5"],"ghsa_id":"GHSA-44fc-8fm5-q62h","id":"tcs_01M5KEZ4TP2848C2KJ1G5DRJND","modified_at":"2026-03-26T19:11:25.646855Z","published_at":"2026-03-26T18:55:41Z","references":["https://osv.dev/vulnerability/GHSA-44fc-8fm5-q62h","https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h","https://github.com/mozilla/node-convict","https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-44fc-8fm5-q62h","url":"https://osv.dev/vulnerability/GHSA-44fc-8fm5-q62h"}],"summary":"Convict has Prototype Pollution via startsWith() function"}