How severe is CVE-2022-22143?

CVE-2022-22143 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2022-22143?

CVE-2022-22143 affects the following packages: convict (npm). Ecosystems affected: npm.

How do I fix CVE-2022-22143?

Update convict to 6.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-22143 is resolved across your whole dependency graph.

How do I detect CVE-2022-22143 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for convict, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-22143 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2022-22143 actively exploited in the wild?

Yes. There are 1 known exploit references for CVE-2022-22143, including 1 in-the-wild exploitation observed on GitHub and other sources. Treat this as actively exploitable and prioritize patching immediately. All exploit code should only be run in an isolated sandbox environment for research or authorized testing — never against production systems without explicit written authorization.

What is the EPSS score for CVE-2022-22143?

CVE-2022-22143 has an EPSS (Exploit Prediction Scoring System) score of 2.2%, placing it in the 82th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2022-22143?

CVE-2022-22143 is classified as CWE-1321 (CWE-1321). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2022-22143 published, and has it been updated?

CVE-2022-22143 was published on May 1, 2022 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

HIGH severity

CVE-2022-22143 — convict

HIGHFix: mozilla/node-convict@3b86be0

CVE-2022-22143 is a high-severity (CVSS 7.5) CWE-1321 vulnerability in convict. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for convict — see the affected versions and patch details below.

Prototype Pollution

Also known asGHSA-x2w5-725j-gf2gSNYK-JS-CONVICT-2340604

Published

May 1, 2022

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

1 known

Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

2.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs82th percentile — riskier than 82% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

924other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

convictnpm

835Kdownloads / week

Description

Impact

An attacker can inject attributes that are used in other components
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

Patches

The problem is patched in [email protected]. Users should upgrade to [email protected].

Workarounds

No way for users to fix or remediate the vulnerability without upgrading

References

https://www.huntr.dev/bounties/1-npm-convict/
#384
3b86be087d8f14681a9c889d45da7fe3ad9cd880
1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75

For more information

If you have any questions or comments about this advisory: add your question as a comment in #384

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`convict`	all versions	6.2.3`npm install convict@6.2.3`

Affected Products

1 product · 1 configurations

Application

convictmozilla

< 6.2.2

range

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

The package convict before 6.2.2 are vulnerable to Prototype Pollution v…

snyk.ioNVDMay 2022

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for convict, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update convict to 6.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-22143 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact * An attacker can inject attributes that are used in other components * An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. ### Patches