Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart.
The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
CWE-400: Uncontrolled Resource Consumption (‘Denial of Service’)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
CWE-915
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-1321
Prototype Pollution
CWE-400
Uncontrolled Resource Consumption
Vulnerable Products
mozilla:node-convict