Node‑convict’s config.set() contains incomplete prototype‑pollution checks, which lets an attacker who can supply a configuration key inject arbitrary properties on the constructor. This causes walk() to resolve to the global Object function and enables the overwrite of core JavaScript methods such as Object.assign, yielding a persistent process‑wide failure that requires a restart.

Mozilla’s Node‑convict library, versions 6.2.2 and later, are affected by this prototype‑pollution flaw.

The CVSS score is 7.5, the EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog. Exploitation needs an endpoint that forwards attacker‑controlled configuration keys to config.set(), so the risk is low to moderate and currently not widespread. The impact is a permanent denial of service affecting the entire application process.