CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
885 vulnerabilities reference this CWE, most recent first.
GHSA-6RF5-GH7P-5VG7
Vulnerability from github – Published: 2025-04-27 21:34 – Updated: 2025-04-27 21:34A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3982"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-27T19:15:15Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6rf5-gh7p-5vg7",
"modified": "2025-04-27T21:34:47Z",
"published": "2025-04-27T21:34:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3982"
},
{
"type": "WEB",
"url": "https://gist.github.com/superboy-zjc/a31b8ea7466f91b437598297bf5cbce8"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306318"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306318"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.557411"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6RV4-4QV6-88G2
Vulnerability from github – Published: 2021-04-12 17:39 – Updated: 2021-04-12 17:39Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-or-get"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.2.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25913"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-12T17:38:22Z",
"nvd_published_at": "2021-02-08T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u2018set-or-get\u2019 version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-6rv4-4qv6-88g2",
"modified": "2021-04-12T17:39:01Z",
"published": "2021-04-12T17:39:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25913"
},
{
"type": "WEB",
"url": "https://github.com/IonicaBizau/set-or-get.js/commit/82ede5cccb2e8d13e4f62599203a4389f6d8e936"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/set-or-get"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25913"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in set-or-get"
}
GHSA-6VJ3-P34W-XXJP
Vulnerability from github – Published: 2025-12-26 18:30 – Updated: 2025-12-26 19:50Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "apidoc-core"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.0"
},
{
"last_affected": "0.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13158"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-26T19:50:17Z",
"nvd_published_at": "2025-12-26T16:15:43Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the \u201cdefine\u201d property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.",
"id": "GHSA-6vj3-p34w-xxjp",
"modified": "2025-12-26T19:50:17Z",
"published": "2025-12-26T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13158"
},
{
"type": "PACKAGE",
"url": "https://github.com/apidoc/apidoc-core"
},
{
"type": "WEB",
"url": "https://www.sonatype.com/security-advisories/cve-2025-13158"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "apidoc-core has a prototype pollution vulnerability"
}
GHSA-6W3J-5FW6-R9VR
Vulnerability from github – Published: 2026-09-08 20:55 – Updated: 2026-09-08 20:55Impact
An application that passes attacker-controlled data into joi's custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named __proto__ was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named constructor did the same to the Object function's statics. A consuming application that gates on the mere presence of a property (if (user.isAdmin)) can be made to take the wrong branch for every object it inspects.
This is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.
Patches
Upgrade to version 18.2.5 or 17.13.6.
Workarounds
Do not pass untrusted input into messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message }). Or validate that they don't contain any __proto__ or constructor property.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "17.2.0"
},
{
"fixed": "17.13.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@hapi/joi"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"last_affected": "17.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "18.0.0"
},
{
"fixed": "18.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-84368"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T20:55:58Z",
"nvd_published_at": "2026-09-01T21:18:47Z",
"severity": "LOW"
},
"details": "### Impact\nAn application that passes attacker-controlled data into joi\u0027s custom message configuration (`messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`) lets the attacker write properties onto `Object.prototype`, where every object in the process then inherits them. A key named `__proto__` was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named `constructor` did the same to the `Object` function\u0027s statics. A consuming application that gates on the mere presence of a property (`if (user.isAdmin)`) can be made to take the wrong branch for every object it inspects.\n\nThis is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.\n\n### Patches\nUpgrade to version 18.2.5 or 17.13.6.\n\n### Workarounds\nDo not pass untrusted input into `messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`. Or validate that they don\u0027t contain any `__proto__` or `constructor` property.",
"id": "GHSA-6w3j-5fw6-r9vr",
"modified": "2026-09-08T20:55:58Z",
"published": "2026-09-08T20:55:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84368"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapijs/joi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
GHSA-6XRF-Q977-5VGC
Vulnerability from github – Published: 2022-12-26 09:30 – Updated: 2024-04-04 13:49A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "json-pointer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-4742"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T17:21:11Z",
"nvd_published_at": "2022-12-26T08:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.",
"id": "GHSA-6xrf-q977-5vgc",
"modified": "2024-04-04T13:49:56Z",
"published": "2022-12-26T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4742"
},
{
"type": "WEB",
"url": "https://github.com/manuelstofer/json-pointer/pull/36"
},
{
"type": "WEB",
"url": "https://github.com/manuelstofer/json-pointer/commit/859c9984b6c407fc2d5a0a7e47c7274daa681941"
},
{
"type": "PACKAGE",
"url": "https://github.com/manuelstofer/json-pointer"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.216794"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.216794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "json-pointer vulnerable to Prototype Pollution"
}
GHSA-6XV4-9CQP-92RH
Vulnerability from github – Published: 2025-09-24 18:30 – Updated: 2025-10-31 15:12The Runtime components of messageformat package for Node.js version 3.0.1 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle. Version 3.0.2 contains a fix.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@messageformat/runtime"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.1"
},
{
"fixed": "3.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.1"
]
}
],
"aliases": [
"CVE-2025-57353"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-24T20:11:09Z",
"nvd_published_at": "2025-09-24T18:15:41Z",
"severity": "MODERATE"
},
"details": "The Runtime components of messageformat package for Node.js version 3.0.1 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application\u0027s lifecycle. Version 3.0.2 contains a fix.",
"id": "GHSA-6xv4-9cqp-92rh",
"modified": "2025-10-31T15:12:38Z",
"published": "2025-09-24T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57353"
},
{
"type": "WEB",
"url": "https://github.com/messageformat/messageformat/issues/453"
},
{
"type": "WEB",
"url": "https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449"
},
{
"type": "WEB",
"url": "https://github.com/messageformat/messageformat/pull/464"
},
{
"type": "WEB",
"url": "https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353"
},
{
"type": "PACKAGE",
"url": "https://github.com/messageformat/messageformat"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "messageformat prototype pollution vulnerability"
}
GHSA-6XWR-Q98W-RVG7
Vulnerability from github – Published: 2022-04-13 00:00 – Updated: 2022-04-22 20:32nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nconf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21803"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-22T20:31:22Z",
"nvd_published_at": "2022-04-12T16:15:00Z",
"severity": "HIGH"
},
"details": "nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.",
"id": "GHSA-6xwr-q98w-rvg7",
"modified": "2022-04-22T20:32:05Z",
"published": "2022-04-13T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21803"
},
{
"type": "WEB",
"url": "https://github.com/indexzero/nconf/pull/397"
},
{
"type": "PACKAGE",
"url": "https://github.com/indexzero/nconf"
},
{
"type": "WEB",
"url": "https://github.com/indexzero/nconf/releases/tag/v0.11.4"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-NCONF-2395478"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in nconf"
}
GHSA-72XF-G2V4-QVF3
Vulnerability from github – Published: 2023-07-01 06:30 – Updated: 2024-06-21 21:33Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tough-cookie"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26136"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-07T21:39:57Z",
"nvd_published_at": "2023-07-01T05:15:16Z",
"severity": "MODERATE"
},
"details": "Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in `rejectPublicSuffixes=false` mode. This issue arises from the manner in which the objects are initialized.",
"id": "GHSA-72xf-g2v4-qvf3",
"modified": "2024-06-21T21:33:53Z",
"published": "2023-07-01T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26136"
},
{
"type": "WEB",
"url": "https://github.com/salesforce/tough-cookie/issues/282"
},
{
"type": "WEB",
"url": "https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e"
},
{
"type": "PACKAGE",
"url": "https://github.com/salesforce/tough-cookie"
},
{
"type": "WEB",
"url": "https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0006"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "tough-cookie Prototype Pollution vulnerability"
}
GHSA-7358-GFXQ-387J
Vulnerability from github – Published: 2024-08-29 03:30 – Updated: 2024-08-29 21:31Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.
{
"affected": [],
"aliases": [
"CVE-2024-45435"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-29T03:15:05Z",
"severity": "CRITICAL"
},
"details": "Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.",
"id": "GHSA-7358-gfxq-387j",
"modified": "2024-08-29T21:31:03Z",
"published": "2024-08-29T03:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45435"
},
{
"type": "WEB",
"url": "https://github.com/chartist-js/chartist/issues/1427"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-737V-MQG7-C878
Vulnerability from github – Published: 2026-04-04 06:17 – Updated: 2026-04-06 23:42Impact
Applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to defu() are vulnerable to prototype pollution.
A crafted payload containing a __proto__ key can override intended default values in the merged result:
import { defu } from 'defu'
const userInput = JSON.parse('{"__proto__":{"isAdmin":true}}')
const config = defu(userInput, { isAdmin: false })
config.isAdmin // true — attacker overrides the server default
Root Cause
The internal _defu function used Object.assign({}, defaults) to copy the defaults object. Object.assign invokes the __proto__ setter, which replaces the resulting object's [[Prototype]] with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing __proto__ key guard in the for...in loop and land in the final result.
Fix
Replace Object.assign({}, defaults) with object spread ({ ...defaults }), which uses [[DefineOwnProperty]] and does not invoke the __proto__ setter.
Affected Versions
<= 6.1.4
Credits
Reported by @BlackHatExploitation
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.1.4"
},
"package": {
"ecosystem": "npm",
"name": "defu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35209"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:17:53Z",
"nvd_published_at": "2026-04-06T18:16:44Z",
"severity": "HIGH"
},
"details": "### Impact\n\nApplications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype pollution.\n\nA crafted payload containing a `__proto__` key can override intended default values in the merged result:\n\n```js\nimport { defu } from \u0027defu\u0027\n\nconst userInput = JSON.parse(\u0027{\"__proto__\":{\"isAdmin\":true}}\u0027)\nconst config = defu(userInput, { isAdmin: false })\n\nconfig.isAdmin // true \u2014 attacker overrides the server default\n```\n\n### Root Cause\n\nThe internal `_defu` function used `Object.assign({}, defaults)` to copy the defaults object. `Object.assign` invokes the `__proto__` setter, which replaces the resulting object\u0027s `[[Prototype]]` with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing `__proto__` key guard in the `for...in` loop and land in the final result.\n\n### Fix\n\nReplace `Object.assign({}, defaults)` with object spread (`{ ...defaults }`), which uses `[[DefineOwnProperty]]` and does not invoke the `__proto__` setter.\n\n### Affected Versions\n\n\u003c= 6.1.4\n\n### Credits\n\nReported by [@BlackHatExploitation](https://github.com/BlackHatExploitation)",
"id": "GHSA-737v-mqg7-c878",
"modified": "2026-04-06T23:42:28Z",
"published": "2026-04-04T06:17:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35209"
},
{
"type": "WEB",
"url": "https://github.com/unjs/defu/pull/156"
},
{
"type": "WEB",
"url": "https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29"
},
{
"type": "PACKAGE",
"url": "https://github.com/unjs/defu"
},
{
"type": "WEB",
"url": "https://github.com/unjs/defu/releases/tag/v6.1.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "defu: Prototype pollution via `__proto__` key in defaults argument"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.