Mozilla node-convict EUVD-2026-93988

Exploitation requires an application that forwards attacker-controlled property names as the key argument into convict's config.set() - for example an HTTP endpoint or form handler that maps untrusted field names to config keys. The attacker must supply a key resolving to constructor.<method> (such as constructor.assign), which walk() resolves to the global Object function; the existing filters only block constructor.prototype.* and __proto__.*, so those specific prefixes do not help. Limiting factors: this is NOT exploitable against a default, hardcoded, or internally-populated convict configuration - only configurations driven by externally-controlled keys are affected, which materially narrows the real-world attack surface despite the AV:N/PR:N rating. Impact is limited to availability (process-wide failure needing a restart); no data disclosure or code execution.

Signals here are moderate and largely consistent with a real-but-not-urgent issue. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates this HIGH purely on availability impact, with no confidentiality or integrity loss. That raw score overstates practical risk because the description adds a hard precondition the CVSS vector does not capture: exploitation 'requires an endpoint that forwards attacker-controlled keys into config.set().' This is a deployment-specific wiring requirement, not a default-configuration remote flaw, so the effective reachability is narrower than AV:N/PR:N implies - verify against the actual application. EPSS is low (0.24%, 14th percentile) and SSVC reports Exploitation: none, meaning no observed or public exploitation; the issue is NOT in CISA KEV and there is no public exploit identified at time of analysis. The one signal pointing to elevated concern is SSVC Automatable: yes - once a vulnerable key-forwarding endpoint exists, the attack is scriptable and repeatable - but Technical Impact is only 'partial' (DoS requiring restart, not code execution). Net: this is a legitimate availability bug worth patching on a normal cycle for teams that pass untrusted keys into convict, but not an emergency given no exploitation, low EPSS, and the non-default exposure requirement.

A Node.js application exposes an API or form endpoint that passes user-supplied field names directly as keys into convict's config.set(). An attacker submits a key resolving to constructor.<method> (e.g. constructor.assign), bypassing the filters that only block constructor.prototype.* and __proto__.*, and overwrites a core method like Object.assign. The corrupted global method causes process-wide failures that persist until the service is restarted. No public exploit code has been identified at time of analysis.