The Weakest Link: Popular Node.js Config Library “Convict” Hit by Prototype Pollution

A critical prototype pollution vulnerability (CVE-2026-33864, CVSS 9.4) was found in the node-convict configuration library (<= 6.2.4). By tampering with String.prototype to defeat a startsWith() check, an attacker can use convict.set to inject properties into Object.prototype, risking authentication bypass, denial of service, or remote code execution; maintainers released version 6.2.5 to patch the issue.