CVE-2026-106550

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: CERT/CC

Description

Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106550

Affected Vendors & Products

Vendor	Product	Version / Range
Mozilla	Node-convict	6.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability is a Denial of Service issue in Mozilla's Node-convict library (version 6.2.2 and later). It stems from incomplete prototype-pollution protections in the config.set() function. An attacker can manipulate configuration keys to overwrite core JavaScript methods like Object.assign by targeting constructor.<key>. This leads to persistent process-wide failures, requiring a restart to recover.

Detection Guidance

To detect this vulnerability, inspect applications using Node-convict 6.2.2 or later for endpoints that pass user-controlled keys into config.set(). Check for unusual property writes to Object.assign or other core methods. No specific commands are provided in the context.

Impact Analysis

If you use Node-convict in your application, an attacker could exploit this to crash your application or cause persistent failures. This could disrupt services, lead to downtime, and require manual intervention to restart the affected process.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data processing failures, which may violate availability requirements in GDPR or HIPAA. Persistent crashes could lead to unauthorized access or data loss if not addressed promptly.

Mitigation Strategies

Immediately upgrade Node-convict to a patched version if available. If not, disable or restrict endpoints that forward user-controlled keys into config.set(). Monitor for signs of exploitation like persistent process failures.

Hi! I’m here to help you understand CVE-2026-106550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70