CVE-2026-35209

What it actually does

This is a JavaScript prototype pollution flaw in the `defu` recursive defaults-merging library before version 6.1.5. When an application passes attacker-controlled data as the first argument to `defu()`, a crafted object containing a `__proto__` key can influence the prototype of the merged result. Because the vulnerable implementation copied defaults using `Object.assign({}, defaults)`, the JavaScript `__proto__` setter could be invoked, causing attacker-controlled inherited properties to appear during later merge logic. The practical impact is integrity compromise of merged configuration or application data: intended default values can be bypassed or replaced. The direct vulnerability does not automatically provide code execution, but impact can become severe if polluted values are later used for authorization decisions, feature flags, security options, URLs, template settings, or other sensitive application behavior.

Why it matters to the business

Applications using vulnerable versions of `unjs defu` may make incorrect decisions based on attacker-influenced configuration or merged object values. Depending on how the application uses `defu()`, this could result in bypassed validation, altered access-control logic, disabled security defaults, unsafe routing or request behavior, or corrupted business logic. The CVSS score is high because exploitation can be remote, unauthenticated, and low complexity when the application merges untrusted input. EPSS is currently low and it is not listed in CISA KEV, but the package may be present transitively in modern JavaScript stacks, so organizations should treat this as a dependency hygiene and application-hardening issue rather than relying only on perimeter detection.

How an attack unfolds

An attacker first identifies an application path that accepts JSON, configuration-like input, stored records, or other user-controlled objects that are later passed into `defu()` as merge input. The attacker submits a payload containing a `__proto__` property with nested attacker-chosen values. In vulnerable versions, the merge process can create a result object whose prototype contains attacker-controlled properties. During recursive merging, inherited properties can be processed as though they were legitimate merge keys, allowing the attacker to override intended defaults in the final merged result. The attacker then triggers application functionality that relies on the affected merged object. The final outcome depends on the consuming application: examples include changing security-relevant defaults, forcing unexpected feature flags, influencing downstream requests, or bypassing application logic that assumes defaults are trustworthy.

How to fix it

Upgrade `unjs defu` to version 6.1.5 or later. If `defu` is introduced transitively, update the parent dependency or use package-manager override mechanisms such as npm `overrides`, Yarn `resolutions`, or pnpm `overrides` to force `defu >= 6.1.5`, then rebuild and redeploy using refreshed lockfiles. As defense in depth, do not pass untrusted objects directly into recursive merge utilities; validate input with an allowlist schema; reject dangerous keys such as `__proto__`, `constructor`, and `prototype`; normalize parsed objects into safe shapes; and consider using null-prototype objects for data that should not inherit properties. Add regression tests that prove crafted prototype-pollution payloads cannot alter merged defaults or introduce inherited properties into security-sensitive configuration.

How to confirm the fix worked

Confirm that all deployed applications and build artifacts resolve `defu` to version 6.1.5 or later. Use dependency inventory commands such as `npm ls defu`, `pnpm why defu`, `yarn why defu`, and software composition analysis results to identify direct and transitive usage. Inspect lockfiles including `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, and `pnpm-lock.yaml` for `defu` versions below 6.1.5. Validate at runtime or in tests by submitting a benign payload such as a JSON object containing `__proto__` and confirming that merged defaults are not overridden, no unexpected inherited properties appear, and `Object.getPrototypeOf()` for merge results is not attacker-controlled. Also verify that input validation rejects or strips prototype-related keys before data reaches merge logic.

Typical attack path

1. Discover an endpoint or workflow that accepts JSON, configuration, preferences, metadata, or other object-like input.
2. Determine that the application or a dependency uses `defu()` to merge that untrusted input with defaults.
3. Send a crafted payload containing a `__proto__` object with properties selected to influence downstream behavior.
4. Allow the vulnerable merge operation to produce an object with attacker-controlled inherited properties.
5. Trigger the feature, authorization check, configuration path, or business process that consumes the polluted merged result.
6. Use the altered behavior to bypass intended defaults, manipulate application logic, or reach a secondary impact specific to the application.

How to detect it

Detection is application-specific because the vulnerable library does not create a universal file, process, or network artifact. To assess possible prior exploitation, review HTTP access logs, API gateway logs, WAF logs, reverse proxy logs, application request logs, and error logs for requests containing prototype-pollution keys such as `__proto__`, especially in JSON bodies, query strings, form data, or uploaded configuration. Include URL-encoded and Unicode-escaped forms of the same key. Review application logs for suspicious changes in merged configuration, unexpected default values, authorization anomalies, feature flag changes, validation bypasses, or unusual downstream requests immediately after such payloads. If the application stores user-supplied JSON or configuration records, search stored records for prototype-pollution keys and determine whether those records were later processed by vulnerable code. For forensic validation, correlate suspicious payloads with authentication context, source IPs, affected endpoints, application errors, and any subsequent privileged or abnormal actions.

• "__proto__"
• '__proto__'
• %22__proto__%22
• %27__proto__%27
• \"__proto__\"
• \u005f\u005fproto\u005f\u005f
• __proto__=
• __proto__[
• __proto__.
• {"__proto__":
• constructor.prototype
• "constructor":{"prototype"
• 'constructor':{'prototype'
• prototype_pollution

What your security team should do

• Prioritize upgrading or overriding `defu` to version 6.1.5 or later across all JavaScript applications and build pipelines.
• Search dependency manifests and lockfiles for vulnerable `defu` versions, including transitive dependencies pulled in by frameworks or build tooling.
• Identify code paths where parsed request bodies, stored records, uploaded configuration, or other untrusted objects are passed to `defu()` or similar recursive merge utilities.
• Add input validation that allowlists expected keys and blocks `__proto__`, `constructor`, and `prototype` in nested user-controlled objects.
• Review security-sensitive use of merged defaults, especially authorization flags, feature flags, redirect or fetch targets, template/rendering options, and validation settings.
• Add regression tests for prototype-pollution payloads and include them in CI for services that process object-like user input.
• Review recent API gateway, WAF, reverse proxy, and application logs for prototype-pollution probes, especially requests containing encoded or literal `__proto__` keys.
• Because there is no KEV listing and EPSS is low, schedule remediation through normal high-severity dependency patching unless exposed application paths use `defu()` with unauthenticated user input, in which case expedite deployment.