convict@5.2.1 vulnerabilities

Featureful configuration management library for Node.js (nested structure, schema validation, etc.)

Direct Vulnerabilities

Known vulnerabilities in the convict package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the FORBIDDEN_KEY_PATHS values when an attacker can inject attributes that are used in other components or override existing attributes with ones that have an incompatible type.

How to fix Denial of Service (DoS)?

Upgrade convict to version 6.2.4 or higher.

<6.2.4
  • H
Prototype Pollution

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Prototype Pollution. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

How to fix Prototype Pollution?

Upgrade convict to version 6.2.3 or higher.

<6.2.3
  • H
Prototype Pollution

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey.

Note: This vulnerability derives from an incomplete fix of another vulnerability

How to fix Prototype Pollution?

Upgrade convict to version 6.2.2 or higher.

<6.2.2
  • H
Prototype Pollution

convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration schema, convict gives project collaborators more context on each setting and enables validation and early failures for when configuration goes wrong.

Affected versions of this package are vulnerable to Prototype Pollution via the convict() function as parentKey is not validated.

How to fix Prototype Pollution?

Upgrade convict to version 6.0.1 or higher.

<6.0.1