Homepage
About Snyk

convict@6.2.3 vulnerabilities

Featureful configuration management library for Node.js (nested structure, schema validation, etc.)

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the convict package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the FORBIDDEN_KEY_PATHS values when an attacker can inject attributes that are used in other components or override existing attributes with ones that have an incompatible type.

How to fix Denial of Service (DoS)?

Upgrade convict to version 6.2.4 or higher.

<6.2.4
Go back to all versions of this package