CVE-2022-22143: Mozilla Convict

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)

Affected products

• Mozilla Convict: before 6.2.2 (fixed in 6.2.2)

Published 2022-05-01. Last modified 2026-06-17.