Node Convict
Monthly
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.