CVE-2026-35209

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input e.g. parsed JSON request bodies, database records, or config files from untrusted sources as the first argument to defu are vulnerable to prototype...

CVE-2026-35209

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input e.g. parsed JSON request bodies, database records, or config files from untrusted sources as the first argument to defu are vulnerable to prototype...

CVE-2026-35209 defu: Prototype pollution via `__proto__` key in defaults argument

defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input e.g. parsed JSON request bodies, database records, or config files from untrusted sources as the first argument to defu are vulnerable to prototype...

@142vip/vue (>=0.1.6-alpha.11 <=0.1.6-alpha.12), @2digits/oxfmt-config (=0.3.0) +472 more potentially affected by CVE-2026-35209 via defu (>=6.0.0 <=6.1.4)

defu NPM version =6.0.0, =0.1.6-alpha.11, =0.0.1, =0.0.3, =1.0.0, =0.1.22, =0.1.23, =0.1.18, =0.1.21 and more Source cves: CVE-2026-35209 Source advisory: SNYK:JS-DEFU-15914644...