{"action":"Upgrade convict to 6.2.5 or later.","affected":[{"fixed":"6.2.5","introduced":"0"}],"component":"convict","cve_ids":["CVE-2026-33863"],"ecosystem":"npm","exploited":false,"fixed_versions":["6.2.5"],"ghsa_id":"GHSA-hf2r-9gf9-rwch","id":"tcs_01M5KFTTBZMRN6EVS9TZAEKBTA","modified_at":"2026-03-26T19:11:25.577317Z","published_at":"2026-03-26T18:50:33Z","references":["https://osv.dev/vulnerability/GHSA-hf2r-9gf9-rwch","https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h","https://github.com/mozilla/node-convict/security/advisories/GHSA-hf2r-9gf9-rwch","https://github.com/mozilla/node-convict/issues/423","https://github.com/mozilla/node-convict"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-hf2r-9gf9-rwch","url":"https://osv.dev/vulnerability/GHSA-hf2r-9gf9-rwch"}],"summary":"Convict has prototype pollution via load(), loadFile(), and schema initialization"}