CVE-2026-106550

Summary

Node-convict library is vulnerable to prototype pollution that allows attackers to overwrite core JavaScript methods like Object.assign, leading to persistent denial of service requiring process restart. The vulnerability bypasses existing protections by targeting constructor.<key> properties instead of just constructor.prototype.* and __proto__.*.

Exploitability

Exploitation requires an endpoint that accepts attacker-controlled configuration keys and forwards them to config.set(), making it moderately difficult to exploit but possible with a vulnerable web application endpoint.

Blast radius

If exploited, this vulnerability could cause persistent process-wide failures requiring restart, affecting all applications using the vulnerable version of Node-convict library, potentially leading to widespread service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Node-convict version 6.2.3 or later which contains the fix for this prototype pollution vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.