Which versions of Node.js are affected by CVE-2026-33863?

Mozilla's node-convict configuration library contains a prototype pollution vulnerability that allows remote attackers to inject malicious properties into core application objects through untrusted…. A patch is available.

How to fix or mitigate CVE-2026-33863?

Within 24 hours: Identify all applications using npm package 'convict' (any version) by auditing package.json and dependency trees across your portfolio; document affected systems and their exposure to untrusted configuration sources. Within 7 days: Implement input validation on all configuration sources feeding into convict.load()/loadFile() methods; disable convict schema initialization from untrusted sources where feasible. Within 30 days: Monitor Mozilla's convict GitHub repository and npm advisories for patch release; prepare upgrade plan to patched version immediately upon availability; consider alternative configuration management libraries if patch timeline extends beyond acceptable risk window.

Node.js CVE-2026-33863

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-26 https://github.com/mozilla/node-convict

Authentication Bypass RCE Node.js Mozilla Prototype Pollution

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 26, 2026 - 19:00 vuln.today

CVE Published

Mar 26, 2026 - 18:50 nvd

CRITICAL

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

995 npm packages depend on convict (223 direct, 777 indirect)

Ecosystem-wide dependent count for version 6.2.5.

DescriptionCVE.org

Impact

Two unguarded prototype pollution paths exist, not covered by previous fixes:

config.load() / config.loadFile() - overlay() recursively merges config data without checking for forbidden keys. Input containing __proto__ or constructor.prototype (e.g. from a JSON file) causes the recursion to reach Object.prototype and write attacker-controlled values onto it.
Schema initialization - passing a schema with constructor.prototype.* keys to convict({...}) causes default-value propagation to write directly to Object.prototype at startup.

Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.

Workarounds

Do not pass untrusted data to load(), loadFile(), or convict().

Resources

Prior advisory: GHSA-44fc-8fm5-q62h Related issue: https://github.com/mozilla/node-convict/issues/423

AnalysisAI

Prototype pollution in Mozilla's node-convict configuration library allows attackers to inject properties into Object.prototype via two unguarded code paths: config.load()/loadFile() methods that fail to filter forbidden keys during recursive merge operations, and schema initialization accepting constructor.prototype.* keys during default-value propagation. Applications using node-convict (pkg:npm/convict) that process untrusted configuration data face impacts ranging from authentication bypass to remote code execution depending on how polluted properties propagate through the application. This represents an incomplete fix for prior prototype pollution issues (GHSA-44fc-8fm5-q62h), with no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability affects Mozilla's node-convict library (CPE: pkg:npm/convict), a configuration management module for Node.js applications that validates and loads configuration from various sources including JSON files and environment variables. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, commonly known as prototype pollution), where the overlay() function recursively merges configuration objects without sanitizing keys like __proto__ or constructor.prototype. JavaScript's prototype chain allows modifications to Object.prototype to propagate globally, enabling attackers to inject properties that affect all objects. The vulnerability bypasses earlier security patches documented in GHSA-44fc-8fm5-q62h, exposing two distinct attack vectors: runtime configuration loading via load()/loadFile() methods and schema initialization during convict() constructor invocation.

RemediationAI

Upgrade to the patched version of node-convict specified in the vendor security advisory at https://github.com/mozilla/node-convict/security/advisories/GHSA-hf2r-9gf9-rwch (exact version number not provided in available intelligence data). As an interim workaround until patching is completed, implement strict input validation to reject configuration data from untrusted sources passed to load(), loadFile(), or convict() constructor methods. Specifically, sanitize or reject any configuration objects containing __proto__, constructor, or prototype keys before processing. Review application architecture to ensure configuration loading occurs only from trusted, controlled sources rather than user-supplied files or external APIs. For defense-in-depth, consider using Object.freeze(Object.prototype) at application startup to prevent prototype modifications, though this may break legitimate application functionality and should be tested thoroughly. Consult the prior advisory GHSA-44fc-8fm5-q62h at https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h for additional context on related prototype pollution patterns in this library.