Executive brief
defu is a software library used by developers to merge configuration settings and object properties. A security flaw allows attackers to inject malicious data that overrides a system's intended default settings. This could lead to unauthorized privilege escalation, such as an attacker granting themselves administrative rights by bypassing internal security checks.
Technical details
A prototype pollution vulnerability exists in defu prior to version 6.1.5. The internal _defu function utilized Object.assign({}, defaults) to clone the defaults object; however, Object.assign triggers the __proto__ setter, allowing an attacker to replace the resulting object's prototype. Because inherited properties from the polluted prototype bypass the library's existing for...in loop guards, malicious values can be injected into the final merged result. The vulnerability is exploitable if unsanitized user input (such as a parsed JSON body) is passed as the first argument to the defu() function. The issue was resolved by replacing Object.assign with object spread syntax ({ ...defaults }), which uses [[DefineOwnProperty]] and avoids invoking the prototype setter.
Affected products
- unjs defu < 6.1.5
Timeline
- 2026-04-01: patched: Fix merged in pull request #156
- 2026-04-02: advisory: GitHub Security Advisory GHSA-737v-mqg7-c878 published
- 2026-04-06: disclosed: CVE-2026-35209 published to NVD