CVE-2026-33864: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33864 is a prototype pollution vulnerability in the convict npm package (used by Mozilla's node-convict project) that allows attackers to pollute Object.prototype via a crafted key passed to convict.set(). It affects all versions of convict up to and including 6.2.4, with version 6.2.5 containing the fix. The vulnerability was published on March 24, 2026, and carries a CVSS v4 base score of 9.4 (Critical) (GitHub Advisory, node-convict Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). A prior fix attempted to block prototype pollution by checking whether user-supplied key paths started with forbidden strings (e.g., constructor, __proto__) using String.prototype.startsWith() at line 564 of main.js. However, an attacker can override String.prototype.startsWith to always return false, bypassing this guard entirely and allowing a key like constructor.prototype.polluted to be processed by convict.set(), which then walks the object path and assigns the value directly to Object.prototype. The precondition for exploitation is that the application must process attacker-controlled input through convict.set() (GitHub Advisory, node-convict Advisory).

Successful exploitation pollutes Object.prototype, affecting all objects in the Node.js process that inherit from it. Depending on how the polluted property is consumed downstream, this can lead to authentication bypass (e.g., overriding security-relevant properties), denial of service (crashing the application through unexpected property values), or remote code execution if the polluted property flows into dangerous sinks such as eval() or child_process functions. Both the vulnerable system and subsequent systems that rely on shared object state are at high risk across confidentiality, integrity, and availability dimensions (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory itself, demonstrating the bypass with a minimal code snippet. No privileges are required and no user interaction is needed to trigger the vulnerability. There is no current evidence of in-the-wild exploitation or threat actor attribution, and the CVE status remains "Reserved" as of the report date. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is currently available (GitHub Advisory, node-convict Advisory).

1. Identify target: Locate a Node.js application that uses convict version ≤ 6.2.4 and exposes an interface (API endpoint, CLI, config file processing) where attacker-controlled strings are passed to convict.set().
2. Override String.prototype.startsWith: In the attacker-controlled execution context (or via a separate injection point), override the built-in method: String.prototype.startsWith = () => false; — this disables the existing prototype pollution guard in convict.
3. Craft malicious key: Prepare a key path targeting Object.prototype, such as constructor.prototype.<property>, paired with a desired value (e.g., 'yes', a function reference, or a payload string).
4. Invoke convict.set(): Trigger the application to call config.set('constructor.prototype.polluted', 'yes') with the crafted key, either directly or through a user-controlled configuration input.
5. Achieve prototype pollution: Verify that Object.prototype is now polluted (e.g., ({}).polluted === 'yes'), meaning all objects in the process inherit the injected property.
6. Escalate impact: Depending on the application, leverage the polluted property to bypass authentication checks, cause denial of service, or — if the property flows into eval() or child_process.exec() — achieve remote code execution (GitHub Advisory, node-convict Advisory).

• Logs: Unexpected errors or crashes in Node.js applications using convict, particularly involving property access on objects that should not have certain keys; stack traces referencing convict/src/main.js around the set() function.
• File System: Presence of convict version 6.2.4 or earlier in node_modules/convict/package.json ("version": "6.2.4").
• Process Behavior: Unusual behavior in Node.js processes where objects unexpectedly inherit new properties at runtime; unexpected calls to eval() or child_process functions originating from configuration-handling code.
• Code Review: Presence of String.prototype.startsWith being overridden anywhere in the application's dependency tree, which may indicate an attempted bypass (GitHub Advisory).

Upgrade the convict npm package to version 6.2.5 or later, which contains the patched fix. The patch replaces the vulnerable startsWith() check with a more robust mechanism that cannot be bypassed by overriding String.prototype. As an interim workaround, avoid passing any attacker-controlled strings directly to convict.set(), and validate/sanitize all key paths before use. Run npm audit or npm update convict to identify and remediate the dependency (GitHub Advisory, node-convict Advisory).

Security Online covered the vulnerability shortly after disclosure, highlighting the prototype pollution risk in node-convict (Security Online). The advisory credits multiple researchers (kevgeoleo, vdata1 as finders; reallyTG, fkiriakos07 as coordinators; toufali as remediation developer; clouserw as remediation reviewer), indicating coordinated disclosure. No major vendor statements or widespread social media discussion beyond the advisory itself have been identified at this time.