{"id":"GHSA-737v-mqg7-c878","summary":"defu: Prototype pollution via `__proto__` key in defaults argument","details":"### Impact\n\nApplications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution.\n\nA crafted payload containing a `__proto__` key can override intended default values in the merged result:\n\n```js\nimport { defu } from 'defu'\n\nconst userInput = JSON.parse('{\"__proto__\":{\"isAdmin\":true}}')\nconst config = defu(userInput, { isAdmin: false })\n\nconfig.isAdmin // true — attacker overrides the server default\n```\n\n### Root Cause\n\nThe internal `_defu` function used `Object.assign({}, defaults)` to copy the defaults object. `Object.assign` invokes the `__proto__` setter, which replaces the resulting object's `[[Prototype]]` with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing `__proto__` key guard in the `for...in` loop and land in the final result.\n\n### Fix\n\nReplace `Object.assign({}, defaults)` with object spread (`{ ...defaults }`), which uses `[[DefineOwnProperty]]` and does not invoke the `__proto__` setter.\n\n### Affected Versions\n\n\u003c= 6.1.4\n\n### Credits\n\nReported by [@BlackHatExploitation](https://github.com/BlackHatExploitation)","aliases":["CVE-2026-35209"],"modified":"2026-07-17T21:07:36.395845640Z","published":"2026-04-04T06:17:53Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-04-04T06:17:53Z","nvd_published_at":"2026-04-06T18:16:44Z","cwe_ids":["CWE-1321"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35209"},{"type":"WEB","url":"https://github.com/unjs/defu/pull/156"},{"type":"WEB","url":"https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29"},{"type":"PACKAGE","url":"https://github.com/unjs/defu"},{"type":"WEB","url":"https://github.com/unjs/defu/releases/tag/v6.1.5"}],"affected":[{"package":{"name":"defu","ecosystem":"npm","purl":"pkg:npm/defu"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.5"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 6.1.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-737v-mqg7-c878/GHSA-737v-mqg7-c878.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}