CVE-2026-106550: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in Mozilla Node-convict

The vulnerability in Node-convict 6.2.2 arises from incomplete protections against prototype pollution in the config.set() method. An attacker controlling configuration keys can inject properties into constructor.<key>, which resolves to the global Object function, enabling overwriting of critical JavaScript methods such as Object.assign. Existing filters block constructor.prototype.* and __proto__.*, but do not prevent this attack vector. This leads to persistent denial of service conditions requiring process restarts. Exploitation depends on the presence of an endpoint that forwards attacker-controlled keys into config.set().

Successful exploitation results in denial of service due to persistent corruption of core JavaScript object methods, causing process-wide failures that require restarting the affected application. This can disrupt availability of services relying on Node-convict 6.2.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid forwarding attacker-controlled keys into config.set() or implement strict input validation to prevent prototype pollution via constructor.<key> properties.