CVE Explorer
CVE-2026-35209
defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution. A crafted payload containing a `__proto__` key can override intended default values in the merged resul. The internal `_defu` function used `Object.assign({}, defaults)` to copy the default
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"defu","vendor":"unjs","versions":[{"status":"affected","version":"< 6.1.5"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-1321","description":"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29","tags":["x_refsource_MISC"],"url":"https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/references/2
{"name":"https://github.com/unjs/defu/pull/156","tags":["x_refsource_MISC"],"url":"https://github.com/unjs/defu/pull/156"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/references/1
{"name":"https://github.com/unjs/defu/releases/tag/v6.1.5","tags":["x_refsource_MISC"],"url":"https://github.com/unjs/defu/releases/tag/v6.1.5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/references/3
{"name":"https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878","tags":["x_refsource_CONFIRM"],"url":"https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:f0c0a7639c29cfb7e4d2b1da1aa6d92497268f2833a0613cb094003585746a37 · sha256:96f63039a78a8df9… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.