CVE-2026-33864: Convict Package Prototype Pollution Vulnerability
Summary
CVE-2026-33864: Convict has Prototype Pollution via startsWith() function. Affects convict versions < 6.2.5. Fixed in 6.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The convict package is an npm module used for configuration management in Node.js applications. It allows developers to define a schema for their configuration files, ensuring that the configuration adheres to specified types and constraints. The package is widely used due to its flexibility and ease of integration. However, a critical vulnerability has been identified that allows for prototype pollution, which can lead to severe security issues in applications relying on this package.
Vulnerability Detail
A prototype pollution vulnerability exists in the convict npm package version 6.2.4. The issue arises from the improper use of the startsWith() function to validate user input against forbidden keys. This vulnerability allows an attacker to manipulate the Object.prototype by providing crafted input, leading to potential security risks such as authentication bypass, denial of service, or remote code execution if the polluted properties are used in unsafe contexts.
How To Fix
Latest published version: 6.2.5 as of 23 Oct 2026
npm install convict@6.2.5The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the convict package until it has been updated. If you must use it, ensure that any user input is sanitized and validated before being processed by the convict library. Here is a code snippet demonstrating how to prevent prototype pollution:
String.prototype.startsWith = () => false;
const convict = require('convict');
let obj = {};
const config = convict(obj);
console.log({}.polluted);
config.set('constructor.prototype.polluted', 'yes');
console.log({}.polluted); // This should not print 'yes'
Conclusion
The prototype pollution vulnerability in the convict package poses significant risks to applications that utilize it. By updating to the latest version, developers can protect their applications from potential exploits. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for convict →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior or security issues in applications.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one. You can also check your application using the Vulert playground without signing up.
The impacts include authentication bypass, denial of service, and remote code execution, depending on how the polluted properties are used within the application.
Yes, the patch is available in convict version 6.2.5. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update the package, implement input validation and sanitization as a temporary workaround to minimize the risk of prototype pollution.
References
Related vulnerabilities
Recent vulnerabilities recorded for convict.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
