{"id":"CVE-2026-106550","published":"2026-10-06T21:17:18.810","lastModified":"2026-10-07T20:17:10.790","description":"Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-915","CWE-1321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mozilla/node-convict","tags":[]},{"url":"https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/mozilla/node-convict","tags":[]},{"url":"https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md","tags":[]}],"hasPoc":true,"ai":{"summary":"Node-convict library is vulnerable to prototype pollution that allows attackers to overwrite core JavaScript methods like Object.assign, leading to persistent denial of service requiring process restart. The vulnerability bypasses existing protections by targeting constructor.<key> properties instead of just constructor.prototype.* and __proto__.*.","exploitability":"Exploitation requires an endpoint that accepts attacker-controlled configuration keys and forwards them to config.set(), making it moderately difficult to exploit but possible with a vulnerable web application endpoint.","blast_radius":"If exploited, this vulnerability could cause persistent process-wide failures requiring restart, affecting all applications using the vulnerable version of Node-convict library, potentially leading to widespread service disruption.","remediation":"Upgrade to Node-convict version 6.2.3 or later which contains the fix for this prototype pollution vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","prototype-pollution","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:04:14.337Z"}}