Is CVE-2026-33864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33864 being exploited in the wild.

How severe is CVE-2026-33864?

Medium severity, with a CVSS score of 4, published 26 March 2026.

Which products and versions are affected?

convict (npm) SEMVER:introduced=0,fixed=6.2.5.

Is there a fix for CVE-2026-33864?

Yes. convict (npm): upgrade to 6.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33864 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-33864?

Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33864: Convict prototype pollution via startsWith bypass

CVE-2026-33864 · Severity: medium · CVSS 4 · Published 2026-03-26

Convict is a Node.js configuration management library used by applications to manage and validate application settings. A prototype pollution vulnerability in versions up to 6.2.4 allows attackers to inject arbitrary properties into JavaScript's Object.prototype by bypassing the validation logic. This could enable attackers to tamper with application behavior, bypass security checks, or crash services in any application that processes untrusted configuration input through Convict.

Technologies: convict (npm). Vendors: npm.

Quick answers

Is CVE-2026-33864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33864 being exploited in the wild.
How severe is CVE-2026-33864?: Medium severity, with a CVSS score of 4, published 26 March 2026.
Which products and versions are affected?: convict (npm) SEMVER:introduced=0,fixed=6.2.5.
Is there a fix for CVE-2026-33864?: Yes. convict (npm): upgrade to 6.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33864 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-33864?: Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

convict (npm): upgrade to 6.2.5 or later
```
npm install convict@6.2.5
```

Technical details

The vulnerability is a prototype pollution flaw in Convict's input validation at line 564 of main.js, which uses String.prototype.startsWith() to block dangerous keys (e.g., "constructor.prototype"). An attacker can override String.prototype.startsWith to return false, bypassing the blocklist check and allowing keys like "constructor.prototype.polluted" to be set via config.set(). Since startsWith() is invoked on user-controlled strings, an attacker who can influence configuration input can pollute Object.prototype with arbitrary properties. The vulnerability affects all versions up to 6.2.4 and is patched in 6.2.5. Attack preconditions include the ability to pass untrusted input to convict.set(), which is locally exploitable if the application processes attacker-controlled config data. The impact ranges from authentication bypass to remote code execution if polluted properties are passed to code sinks like eval() or child_process().

Affected products

Mozilla Convict <=6.2.4

Identifiers

CVE-2026-33864
GHSA-44fc-8fm5-q62h

Timeline

2026-03-26: disclosed: Advisory published
2026-03-26: patched: Fix released in version 6.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.