# CVE-2026-33863: convict RCE — Fixed in 6.2.5

📦 npm

Not in CISA KEV

# CVE-2026-33863 — convict

CVE-2026-33863 is a remote code execution vulnerability in convict. A fix is available for convict — see the affected versions and patch details below.

Convict has prototype pollution via load(), loadFile(), and schema initialization

Published

Mar 26, 2026

Updated

Mar 26, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Mar 26, 2026 · OSV.dev, FIRST.org (EPSS)

## Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

918other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

`convict`npm

1.7Mdownloads / week

## Description

#### Impact

Two unguarded prototype pollution paths exist, not covered by previous fixes:

1.  `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing `__proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.
2.  Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.

Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.

#### Workarounds

Do not pass untrusted data to load(), loadFile(), or convict().

#### Resources

Prior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h) Related issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`convict` 

all versions

6.2.5`npm install convict@6.2.5`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for convict, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update convict to 6.2.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-33863 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
    

## Frequently Asked Questions

\### Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. \`config.load()\` / \`config.loadFile()\` — \`overlay()\` recursively merges config data without checking for forbidden keys. Input containing\` \_\_proto\_\_\` or \`constructor.prototype\` (e.g. from a JSON file) causes the recursion to reach \`Object.prototype\` and write attacker-controlled values onto it. 2. Schema initialization — passing a schema with \`constructor.prototype.\*\` keys to \`convict({...})\` causes default-value propagation to write directly to \`Object.prototype\` at startup. Depending on how polluted

O3 Security · Impact-Aware SCA

### Is CVE-2026-33863 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)