Executive brief
Alibaba Fusion Next is a popular React component library used to build web applications. A prototype pollution vulnerability in the locale configuration merging function allows remote attackers to poison global object prototypes through crafted locale configurations, potentially causing application denial of service or unexpected behavior across the entire application.
Technical details
The vulnerability is a prototype pollution flaw in the `ConfigProvider.getContextProps()` method, which uses an unsafe `deepMerge()` utility that does not filter prototype-related keys such as `__proto__`, `constructor`, or `prototype`. When merging user-supplied `locale` objects containing these keys, the function writes directly to `Object.prototype`. The flaw is reachable through multiple public APIs: direct `ConfigProvider.getContextProps()` calls, component props passed to wrapped components, context-based locale configuration, and global methods like `ConfigProvider.setLocale()` and `ConfigProvider.initLocales()`. No authentication is required; a malicious locale object can be injected through any of these paths. An attacker can poison prototype properties to break application functionality (e.g., overwriting `toString`) or inject malicious properties into all objects in the application. Patches are expected from the maintainers; users should upgrade to a patched version when available.
Affected products
- Alibaba Fusion Next up to 1.27.34
Timeline
- 2026-08-24: disclosed: CVE-2026-78180 published on NVD