CVE-2022-22143

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)

• CWE-1321

• https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569Broken Link
• https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-CONVICT-2340604Exploit, Patch, Third Party Advisory
• https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569Broken Link
• https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-CONVICT-2340604Exploit, Patch, Third Party Advisory

Published

May 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22138All versions of package fast-string-search are vulnerable to…7.5
• CVE-2022-22139Uncontrolled search path in the Intel(R) XTU software before…7.3
• CVE-2022-2214A vulnerability was found in SourceCodester Library Manageme…8.8
• CVE-2022-22140An os command injection vulnerability exists in the confsrv …9.8
• CVE-2022-22141'Long-term Data Archive Package' service implemented in the …7.8
• CVE-2022-22142Reflected cross-site scripting vulnerability in the checkbox…6.1
• CVE-2022-22144A hard-coded password vulnerability exists in the libcommonp…9.8
• CVE-2022-22145CAMS for HIS Log Server contained in the following Yokogawa …8.1
• CVE-2022-22146Cross-site scripting vulnerability in TransmitMail 2.5.0 to …6.1
• CVE-2022-22147Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2022-22148'Root Service' service implemented in the following Yokogawa…7.8
• CVE-2022-22149A SQL injection vulnerability exists in the HelpdeskEmailAct…8.8