Threats tagged 'ghsa-37q3-7h5g-p75h'

Mozilla's Node-convict version 6.2.2 is affected by a prototype pollution vulnerability in the config.set() function. This flaw allows an attacker who can control configuration keys to overwrite core JavaScript methods such as Object.assign by writing arbitrary properties to constructor.<key>. The vulnerability bypasses existing filters and can cause persistent process-wide failures, resulting in denial of service that requires a restart. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().