CVE-2026-35209: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35209 is a prototype pollution vulnerability in the defu npm library (by unjs) that allows unauthenticated remote attackers to override security-critical default values by passing a crafted __proto__ key in unsanitized user input to the defu() function. It affects all versions of defu up to and including 6.1.4 for Node.js. The vulnerability was reported by @BlackHatExploitation, fixed in a pull request merged on April 1, 2026, and published to the GitHub Advisory Database on April 4, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, unjs/defu Security Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The internal _defu function used Object.assign({}, defaults) to copy the defaults object; Object.assign invokes the __proto__ setter, which replaces the resulting object's [[Prototype]] with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing __proto__ key guard in the for...in loop and appear in the final merged result. Exploitation requires only network access with no privileges or user interaction — an attacker simply supplies a JSON payload such as {"__proto__":{"isAdmin":true}} as the first argument to defu() (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to override security-critical default values set by the application, such as privilege flags (e.g., isAdmin), potentially enabling unauthorized privilege escalation and security control bypass. Because the pollution affects the JavaScript object prototype chain, the impact can propagate across the entire application runtime, affecting any object that inherits from the polluted prototype. Confidentiality and availability are not directly impacted, but integrity is rated High due to the ability to manipulate application logic and authorization decisions (GitHub Advisory, unjs/defu Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031% (0.018% per GitHub Advisory), placing it in a low percentile for near-term exploitation likelihood. No threat actor attribution has been identified.

1. Identify a vulnerable target: Find a Node.js application using defu version 6.1.4 or earlier that passes unsanitized user-controlled input (e.g., a parsed JSON request body) as the first argument to defu().
2. Craft a malicious payload: Construct a JSON payload containing a __proto__ key with attacker-desired property overrides, e.g., {"__proto__":{"isAdmin":true}}.
3. Submit the payload: Send the crafted payload to the application via an HTTP request body, API endpoint, or any other input channel that feeds into the defu() call without sanitization.
4. Trigger prototype pollution: The application parses the JSON and passes the resulting object to defu(). The Object.assign({}, defaults) call internally invokes the __proto__ setter, polluting the object prototype with the attacker-supplied values.
5. Achieve privilege escalation or security bypass: The polluted prototype causes security-critical properties (e.g., isAdmin) to evaluate to attacker-controlled values, bypassing authorization checks or other security controls in the application (GitHub Advisory, Fix PR).

• Network: Unexpected HTTP requests containing JSON bodies with __proto__ keys (e.g., {"__proto__":{...}}) sent to API endpoints that process configuration or user input.
• Logs: Application logs showing unexpected privilege escalation events or authorization bypasses (e.g., non-admin users accessing admin functionality); Node.js error logs referencing prototype chain anomalies.
• Application Behavior: Security-critical boolean flags (e.g., isAdmin, isAuthenticated) evaluating to unexpected values; objects inheriting unexpected properties not set by application code.
• Dependency Audit: Presence of defu version 6.1.4 or earlier in package.json or package-lock.json / yarn.lock files (GitHub Advisory).

Upgrade defu to version 6.1.5 or later, which replaces Object.assign({}, defaults) with object spread syntax ({ ...defaults }), preventing the __proto__ setter from being invoked (defu v6.1.5 Release, Fix Commit). For applications unable to update immediately, implement input validation to strip or reject any __proto__, constructor, or prototype keys from user-supplied JSON before passing data to defu(). Additionally, consider using allowlists for expected configuration properties and validate critical default values post-merge to detect unexpected modifications (GitHub Advisory).

The fix was reviewed and merged by pi0 (the defu maintainer) on April 1, 2026, with a positive reception indicated by a heart reaction on the pull request. The vulnerability was noted in downstream dependency update PRs across multiple open-source projects (e.g., better-together-vue, commercelayer-js-auth, astro-blog-starter-template), indicating broad ecosystem awareness. No significant media coverage or notable researcher commentary beyond the advisory itself has been identified (Fix PR).