Is CVE-2026-78180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78180 being exploited in the wild.

How severe is CVE-2026-78180?

High severity, with a CVSS score of 7.3, published 24 August 2026.

Which products and versions are affected?

Alibaba Fusion Next up to 1.27.34.

Is there a fix for CVE-2026-78180?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78180?

Check whether you run Alibaba Fusion Next at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78180: Alibaba Fusion Next prototype pollution in ConfigProvider locale merging

CVE-2026-78180 · Severity: high · CVSS 7.3 · Published 2026-08-24

Alibaba Fusion Next is a popular React component library used to build web applications. A prototype pollution vulnerability in the locale configuration merging function allows remote attackers to poison global object prototypes through crafted locale configurations, potentially causing application denial of service or unexpected behavior across the entire application.

Vendors: Alibaba.

Quick answers

Is CVE-2026-78180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78180 being exploited in the wild.
How severe is CVE-2026-78180?: High severity, with a CVSS score of 7.3, published 24 August 2026.
Which products and versions are affected?: Alibaba Fusion Next up to 1.27.34.
Is there a fix for CVE-2026-78180?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78180?: Check whether you run Alibaba Fusion Next at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a prototype pollution flaw in the `ConfigProvider.getContextProps()` method, which uses an unsafe `deepMerge()` utility that does not filter prototype-related keys such as `__proto__`, `constructor`, or `prototype`. When merging user-supplied `locale` objects containing these keys, the function writes directly to `Object.prototype`. The flaw is reachable through multiple public APIs: direct `ConfigProvider.getContextProps()` calls, component props passed to wrapped components, context-based locale configuration, and global methods like `ConfigProvider.setLocale()` and `ConfigProvider.initLocales()`. No authentication is required; a malicious locale object can be injected through any of these paths. An attacker can poison prototype properties to break application functionality (e.g., overwriting `toString`) or inject malicious properties into all objects in the application. Patches are expected from the maintainers; users should upgrade to a patched version when available.

Affected products

Alibaba Fusion Next up to 1.27.34

Timeline

2026-08-24: disclosed: CVE-2026-78180 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.