CVE-2026-106550 in Node-convict
Summary
by MITRE • 10/07/2026
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Mozilla's Node-convict library, specifically affecting versions 6.2.2 and later, represents a critical security flaw rooted in incomplete prototype pollution protections within the configuration management system. This issue allows attackers to manipulate the internal state of JavaScript objects by exploiting how the config.set() method handles input keys. The core technical failure lies in the library's attempt to sanitize user-supplied property names before assigning them to object properties. While existing filters were designed to block direct attempts at prototype pollution through standard paths such as constructor.prototype. and _proto_., they failed to account for alternative resolution mechanisms inherent to JavaScript's prototype chain traversal logic. Specifically, when an attacker controls the configuration key passed to config.set(), they can craft a payload that writes arbitrary properties to constructor.<key>. This path is significant because in many JavaScript environments, particularly those running on Node.js, resolving this property leads directly back to the global Object function due to how walk() resolves references during object traversal.
This architectural oversight enables an attacker to overwrite core JavaScript methods such as Object.assign with malicious or malformed values. The impact of overwriting these fundamental built-in functions is severe and pervasive across the application runtime environment. Since Node.js applications often rely on standard library functions for data manipulation, serialization, and merging objects, corrupting these methods causes persistent process-wide failures. Unlike transient errors that might be caught by local try-catch blocks, the corruption of global prototypes affects all subsequent operations within the running process. This results in a Denial of Service condition where the application becomes unstable or unresponsive until it is manually restarted to clear the corrupted prototype chain. The persistence of this state means that even if the initial request causing the pollution ends successfully, the damage remains active for the lifetime of the Node.js process instance.
From an operational perspective, exploitation requires a specific entry point within the target application where attacker-controlled keys are forwarded directly into config.set(). This typically occurs in web applications or APIs that allow dynamic configuration updates based on user input without sufficient validation. The vulnerability bypasses existing security filters because those filters operate under the assumption that prototype pollution can only occur through explicit references to _proto_ or constructor.prototype properties. They do not anticipate indirect paths where property names are resolved dynamically against the global scope. This gap in defensive logic highlights a common challenge in securing JavaScript applications, where the flexibility of dynamic object manipulation is often exploited by attackers who understand the underlying engine behavior better than static analysis tools might predict.
The classification of this vulnerability aligns with CWE-1321: Improperly Controlled Prototype Modification and falls under MITRE ATT&CK technique T1059, specifically within the context of command and script interpretation or potentially system configuration modification depending on how deeply the application relies on these core functions for critical operations. The lack of robust input validation allows an unauthenticated attacker to degrade service availability without needing elevated privileges, provided they can interact with the vulnerable endpoint. This underscores the importance of treating all user-controlled inputs that influence object property names as high-risk vectors requiring strict allow-listing rather than block-listing approaches.
To mitigate this vulnerability, developers must update Node-convict to a patched version where prototype pollution protections have been strengthened to handle indirect resolution paths and global scope interference. In addition to upgrading the library, application-level defenses should be implemented to validate configuration keys against a predefined set of allowed property names before they are passed to any setter methods. Input sanitization strategies must move beyond simple string matching for known dangerous properties like _proto_ or constructor.prototype and instead enforce strict schema validation that rejects any key containing characters indicative of prototype manipulation, including dots in specific positions or keywords associated with object prototypes. Furthermore, implementing runtime integrity checks can help detect if core JavaScript functions have been modified, allowing the application to fail safely rather than continuing in a corrupted state. Regular security audits focusing on dynamic property assignment patterns are essential to prevent similar issues in other parts of the codebase that may rely on similar configuration management libraries or custom object manipulation logic.