p PatchFirst

CVE-2022-22143

CVE-2022-22143 · Prototype Pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)

CVSS 7.5 · High · EPSS 2.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • convict

    Versions
    • ≥ unspecified, < 6.2.2: Affected (custom)

    Update to 6.2.2

  • convict npm

    Affected ranges
    • SEMVER: < 6.2.3

    Update to 6.2.3

Original sources

Check your server →