# CVE-2022-21190: convict prototype pollution vulnerability

Source: https://junglewise.ai/threats/cve-2022-21190-convict-prototype-pollution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-21190 · Severity: low · CVSS 3.1 · Published 2022-05-14

convict is a configuration management library for Node.js applications. A prototype pollution vulnerability allows attackers to modify JavaScript object properties at runtime, potentially enabling denial of service, code execution, or data tampering in applications using the affected version.

Technologies: [convict (npm)](https://junglewise.ai/threats/technologies/convict). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-21190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-21190 being exploited in the wild.

**How severe is CVE-2022-21190?** Low severity, with a CVSS score of 3.1, published 14 May 2022.

**Which products and versions are affected?** convict (npm) SEMVER:introduced=0,fixed=6.2.3.

**Is there a fix for CVE-2022-21190?** Yes. convict (npm): upgrade to 6.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-21190 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-21190?** Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- convict (npm): upgrade to 6.2.3 or later

  ```sh
  npm install convict@6.2.3
  ```


## Technical details

This is a prototype pollution vulnerability (CWE-1321) in convict before version 6.2.3 that bypasses a previous patch for CVE-2022-22143. The original fix checked if paths started with "proto" or "this.constructor.prototype" but the check is incomplete; attackers can prepend arbitrary strings followed by a dot (e.g., "foo.proto" or "foo.this.constructor.prototype") to bypass the protection. The vulnerability is network-reachable if the application processes untrusted configuration input, requiring no authentication or user interaction. A successful exploit allows modification of arbitrary object properties, leading to denial of service or potential code execution depending on the application's use of the library. A complete fix was released in version 6.2.3.

## Affected products

- Mozilla convict before 6.2.3

## Identifiers

- CVE-2022-21190
- GHSA-jjf5-wx3j-3fv7

## Timeline

- 2022-05-14: disclosed
- 2022-05-07: patched: Fix released in version 6.2.3

## References

- [https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75](https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75)

## Related threats

- [Convict prototype pollution via startsWith bypass](https://junglewise.ai/threats/cve-2026-33864-convict-prototype-pollution-via-startswith-bypass)
- [Convict prototype pollution in load and loadFile](https://junglewise.ai/threats/cve-2026-33863-convict-prototype-pollution-in-load-and-loadfile)
- [convict prototype pollution](https://junglewise.ai/threats/cve-2023-0163-convict-prototype-pollution)
- [Mozilla Convict prototype pollution in configuration handling](https://junglewise.ai/threats/cve-2022-22143-mozilla-convict-prototype-pollution-in-configuration-handling)