CVE-2026-35209

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution. A crafted payload containing a `__proto__` key can override intended default values in the merged resul. The internal `_defu` function used `Object.assign({}, defaults)` to copy the defaults object. `Object.assign` invokes the `__proto__` setter, which replaces the resulting object's `[[Prototype]]` with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing `__proto__` key guard in the `for...in` loop and land in the final result. Version 6.1.5 replaces `Object.assign({}, defaults)` with object spread (`{ ...defaults }`), which uses `[[DefineOwnProperty]]` and does not invoke the `__proto__` setter.

• CWE-1321

• https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29Patch
• https://github.com/unjs/defu/pull/156Issue Tracking, Patch
• https://github.com/unjs/defu/releases/tag/v6.1.5Release Notes
• https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35203ZLMediaKit is a streaming media service framework. the VP9 R…7.5
• CVE-2026-35204Helm is a package manager for Charts for Kubernetes. From 4.…8.6
• CVE-2026-35205Helm is a package manager for Charts for Kubernetes. From 4.…7.8
• CVE-2026-35206Helm is a package manager for Charts for Kubernetes. In Helm…4.4
• CVE-2026-35207dde-control-center is the control panel of DDE, the Deepin D…5.4
• CVE-2026-35208lichess.org is the forever free, adless and open source ches…5.4
• CVE-2026-35210OpenCTI is an open source platform for managing cyber threat…7.1
• CVE-2026-35211OpenCTI is an open source platform for managing cyber threat…6.5
• CVE-2026-35212OpenCTI is an open source platform for managing cyber threat…6.1
• CVE-2026-35213@hapi/content provided HTTP Content-* headers parsing. All v…7.5
• CVE-2026-35214Budibase is an open-source low-code platform. Prior to versi…8.7
• CVE-2026-35215Firebird is an open-source relational database management sy…7.5