Which versions of Node.js are affected by CVE-2026-33864?

The convict npm package (version 6.2.4) contains a critical prototype pollution vulnerability that allows attackers to bypass existing security controls and manipulate core JavaScript object behavior…. A patch is available.

How to fix or mitigate CVE-2026-33864?

Within 24 hours: Inventory all applications and dependencies using convict npm package and identify those processing untrusted input via convict.set(). Assess whether affected instances handle sensitive operations (authentication, payment processing, administrative functions). Within 7 days: Implement input validation and sanitization layers ahead of convict.set() calls; consider temporary removal or isolation of convict from production if alternative configuration management exists. Within 30 days: Monitor convict project repository and npm advisory channels for patch release; establish upgrade plan for immediate deployment once patched version becomes available; if no patch emerges, evaluate community-maintained forks or replacement libraries.

Node.js CVE-2026-33864

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-26 https://github.com/mozilla/node-convict

Authentication Bypass RCE Denial Of Service Node.js Mozilla Prototype Pollution

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 26, 2026 - 19:00 vuln.today

CVE Published

Mar 26, 2026 - 18:55 nvd

CRITICAL

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

995 npm packages depend on convict (223 direct, 777 indirect)

Ecosystem-wide dependent count for version 6.2.5.

DescriptionCVE.org

Summary

A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype.

Details

The vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where startsWith() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

Install latest version of convict using npm install or cloning from git
Run the following code snippet:

javascript

String.prototype.startsWith = () => false;
const convict = require('convict');
let obj = {};
const config = convict(obj);
console.log({}.polluted);
config.set('constructor.prototype.polluted', 'yes');
console.log({}.polluted);    // prints yes -> the patch is bypassed and prototype pollution occurred

Expected behavior

Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted This is printed on the console:

undefined
yes

Impact

This is a prototype pollution vulnerability, which can have severe security implications depending on how convict is used by downstream applications. Any application that processes attacker-controlled input using convict.set may be affected. It could potentially lead to the following problems:

Authentication bypass
Denial of service
Remote code execution (if polluted property is passed to sinks like eval or child_process)

AnalysisAI

Prototype pollution in convict npm package version 6.2.4 allows attackers to bypass previous security fixes and pollute Object.prototype through crafted input that manipulates String.prototype.startsWith. The vulnerability affects applications processing untrusted input via convict.set() and can lead to authentication bypass, denial of service, or remote code execution if polluted properties reach dangerous sinks like eval or child_process. A working proof-of-concept exploit demonstrating the bypass technique exists in the advisory.

Technical ContextAI

Convict is a Mozilla-maintained configuration management library for Node.js applications (pkg:npm/convict). The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, or Prototype Pollution), a critical weakness in JavaScript where attackers modify Object.prototype to inject properties into all objects. The flaw exists in line 564 of main.js where the startsWith() function checks user input for forbidden keys like 'constructor' or 'prototype'. By overriding String.prototype.startsWith to always return false, attackers can bypass the validation logic that was implemented to fix previous prototype pollution issues. This allows injection of properties like 'constructor.prototype.polluted' which propagate to all JavaScript objects in the application runtime.

RemediationAI

No vendor-released patch version is identified at the time of analysis based on the available data indicating version 6.2.4 remains the latest affected release. Monitor the Mozilla node-convict GitHub repository at github.com/mozilla/node-convict and the GitHub Security Advisory GHSA-44fc-8fm5-q62h for patch announcements. Until a fixed version is released, implement defensive controls: validate and sanitize all user input before passing to convict.set(), implement Object.freeze(Object.prototype) immediately after application initialization to prevent prototype modifications, use object creation without prototype inheritance via Object.create(null) for sensitive data structures, and restrict the ability for untrusted users to control configuration keys. Consider replacing convict with alternative configuration libraries that implement stronger prototype pollution protections if immediate remediation is required.