convict 4.3.0 vulnerabilities

Known vulnerabilities in the convict package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Prototype Pollution convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong. Affected versions of this package are vulnerable to Prototype Pollution via the `FORBIDDEN_KEY_PATHS` values when an attacker can inject attributes that are used in other components or override existing attributes with ones that have an incompatible type. How to fix Prototype Pollution? Upgrade `convict` to version 6.2.4 or higher.	<6.2.4
H Prototype Pollution convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong. Affected versions of this package are vulnerable to Prototype Pollution. This is a bypass of `CVE-2022-22143`. The fix introduced, relies on the `startsWith` method and does not prevent the vulnerability: before splitting the path, it checks if it starts with `__proto__` or `this.constructor.prototype`. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example `foo.__proto__` or `foo.this.constructor.prototype`. How to fix Prototype Pollution? Upgrade `convict` to version 6.2.3 or higher.	<6.2.3
H Prototype Pollution convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong. Affected versions of this package are vulnerable to Prototype Pollution via the `convict` function due to missing validation of `parentKey`. Note: This vulnerability derives from an incomplete fix of another vulnerability How to fix Prototype Pollution? Upgrade `convict` to version 6.2.2 or higher.	<6.2.2
H Prototype Pollution convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong. Affected versions of this package are vulnerable to Prototype Pollution via the `convict()` function as `parentKey` is not validated. How to fix Prototype Pollution? Upgrade `convict` to version 6.0.1 or higher.	<6.0.1

Vulnerability

Vulnerable Version

Prototype Pollution

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Prototype Pollution via the FORBIDDEN_KEY_PATHS values when an attacker can inject attributes that are used in other components or override existing attributes with ones that have an incompatible type.

How to fix Prototype Pollution?

Upgrade convict to version 6.2.4 or higher.

<6.2.4

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

How to fix Prototype Pollution?

Upgrade convict to version 6.2.3 or higher.

<6.2.3

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey.

Note: This vulnerability derives from an incomplete fix of another vulnerability

How to fix Prototype Pollution?

Upgrade convict to version 6.2.2 or higher.

<6.2.2

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution via the convict() function as parentKey is not validated.

How to fix Prototype Pollution?

Upgrade convict to version 6.0.1 or higher.

<6.0.1

convict@4.3.0 vulnerabilities

Featureful configuration management library for Node.js (nested structure, schema validation, etc.)

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?