{"id":"CVE-2026-35209","aliases":["GHSA-737v-mqg7-c878"],"url":"https://o3.security/vulnerability/CVE-2026-35209","summary":"defu: Prototype pollution via `__proto__` key in defaults argument","details":"### Impact\n\nApplications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution.\n\nA crafted payload containing a `__proto__` key can override intended default values in the merged result:\n\n```js\nimport { defu } from 'defu'\n\nconst userInput = JSON.parse('{\"__proto__\":{\"isAdmin\":true}}')\nconst config = defu(userInput, { isAdmin: false })\n\nconfig.isAdmin // true — attacker overrides the server default\n```\n\n### Root Cause\n\nThe internal `_defu` function used `Object.assign({}, defaults)` to copy the defaults object. `Object.assign` invokes the `__proto__` setter, which replaces the resulting object's `[[Prototype]]` with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing `__proto__` key guard in the `for...in` loop and land in the final result.\n\n### Fix\n\nReplace `Object.assign({}, defaults)` with object spread (`{ ...defaults }`), which uses `[[DefineOwnProperty]]` and does not invoke the `__proto__` setter.\n\n### Affected Versions\n\n<= 6.1.4\n\n### Credits\n\nReported by [@BlackHatExploitation](https://github.com/BlackHatExploitation)","published":"2026-04-06T17:26:52.975Z","modified":"2026-08-12T03:51:10.686926192Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"defu","fixedVersion":"6.1.5"}],"fix":{"url":"https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29","label":"unjs/defu@3942bfb"},"references":[{"type":"WEB","url":"https://github.com/unjs/defu/releases/tag/v6.1.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35209.json"},{"type":"ADVISORY","url":"https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35209"},{"type":"FIX","url":"https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29"},{"type":"FIX","url":"https://github.com/unjs/defu/pull/156"},{"type":"PACKAGE","url":"https://github.com/unjs/defu"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.686926192Z"}}