Denial of Service Vulnerability in Mozilla's Node-convict

CVE-2026-106550

What is CVE-2026-106550?

Mozilla's Node-convict, starting from version 6.2.2, is affected by a Denial of Service vulnerability stemming from inadequate protections against prototype pollution in its config.set() function. This flaw allows attackers with control over configuration keys to overwrite core JavaScript methods, such as Object.assign, leading to widespread disruptions that make the application require a restart. The vulnerability exploits a gap in existing security measures that inadequately filter certain constructor-related properties, resulting in process-wide failures.

References