CVE-2026-35209: unjs defu prototype pollution in defaults merging

CVE-2026-35209 · Severity: high · CVSS 7.5 · Published 2026-04-06

defu is a software library used by developers to merge configuration settings and object properties. A security flaw allows attackers to inject malicious data that overrides a system's intended default settings. This could lead to unauthorized privilege escalation, such as an attacker granting themselves administrative rights by bypassing internal security checks.

Vendors: npm, UnJS.

Quick answers

Is CVE-2026-35209 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35209 being exploited in the wild.
How severe is CVE-2026-35209?
High severity, with a CVSS score of 7.5, published 6 April 2026.
Which products and versions are affected?
defu (npm) SEMVER:introduced=0,fixed=6.1.5; UnJS Defu < 6.1.5.
Is there a fix for CVE-2026-35209?
Yes. defu (npm): upgrade to 6.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35209 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35209?
Check whether you run defu (npm) or UnJS Defu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • defu (npm): upgrade to 6.1.5 or later
    npm install defu@6.1.5

Technical details

A prototype pollution vulnerability exists in defu prior to version 6.1.5. The internal _defu function utilized Object.assign({}, defaults) to clone the defaults object; however, Object.assign triggers the __proto__ setter, allowing an attacker to replace the resulting object's prototype. Because inherited properties from the polluted prototype bypass the library's existing for...in loop guards, malicious values can be injected into the final merged result. The vulnerability is exploitable if unsanitized user input (such as a parsed JSON body) is passed as the first argument to the defu() function. The issue was resolved by replacing Object.assign with object spread syntax ({ ...defaults }), which uses [[DefineOwnProperty]] and avoids invoking the prototype setter.

Affected products

  • unjs defu < 6.1.5

Identifiers

  • CVE-2026-35209
  • GHSA-737v-mqg7-c878

Timeline

  • 2026-04-01: patched: Fix merged in pull request #156
  • 2026-04-02: advisory: GitHub Security Advisory GHSA-737v-mqg7-c878 published
  • 2026-04-06: disclosed: CVE-2026-35209 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.