CRITICALnpm
GHSA-44fc-8fm5-q62h· CVE-2026-33864Convict has Prototype Pollution via startsWith() function
Modified: 3/26/2026
package
npm/convict
pkg:npm/convict
HIGH8.4npm
GHSA-4jrm-c32x-w4jf· CVE-2023-0163convict vulnerable to Prototype Pollution
Modified: 11/26/2024
CRITICALnpm
GHSA-hf2r-9gf9-rwch· CVE-2026-33863Convict has prototype pollution via load(), loadFile(), and schema initialization
Modified: 3/26/2026
CRITICAL9.8npm
GHSA-jjf5-wx3j-3fv7· CVE-2022-21190, SNYK-JS-CONVICT-2774757Prototype Pollution in convict
Modified: 7/8/2026
HIGH8.4npm
GHSA-x2w5-725j-gf2g· CVE-2022-22143, SNYK-JS-CONVICT-2340604Prototype Pollution in convict
Modified: 9/10/2026