CVE-2026-35209

VULNERABILITY OVERVIEW CVE-2026-35209 is a prototype pollution vulnerability affecting the defu library prior to version 6.1.5. The vulnerability exists in the library's core recursive property assignment function, which allows attackers to manipulate JavaScript object prototypes through unsanitized user input. Applications that directly pass untrusted data sources—such as JSON request bodies, database records, or configuration files—to the defu() function are at risk of having their intended default values overridden by attacker-controlled properties. SEVERITY ASSESSMENT This vulnerability carries a CVSS score of 7.5 (HIGH) with network-based exploitation requiring no authentication, user interaction, or elevated privileges. The attack is straightforward to execute with low complexity. While the vulnerability does not compromise confidentiality or availability, it poses a significant integrity risk by allowing attackers to alter application behavior through prototype pollution. The exploit mechanism leverages the Object.assign() function's invocation of the __proto__ setter, enabling pollution despite existing guards. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Community attention appears limited, reflected in a FAUCET risk score of 48.0 out of 100. However, organizations running defu versions before 6.1.5 should prioritize updating, as the fix is straightforward and the vulnerability's accessibility remains a latent risk. Users should upgrade to version 6.1.5 or later, which resolves the issue by replacing Object.assign with object spread syntax.