平台
nodejs
组件
defu
修复版本
6.1.6
6.1.5
CVE-2026-35209 是 defu 库中的一个原型污染漏洞。当应用程序将未经处理的用户输入作为第一个参数传递给 defu() 函数时，就可能受到原型污染攻击。攻击者可以构造包含 proto 键的恶意载荷，覆盖合并结果中的默认值。受影响的版本包括 6.1.5 之前的版本。此问题已在 6.1.5 版本中修复。
Prototype pollution occurs when an attacker can modify the prototype of JavaScript objects, effectively altering the behavior of all objects inheriting from that prototype. In the context of defu, an attacker can inject a proto key into user-supplied data (like JSON request bodies or configuration files) and pass it to the defu() function. This allows them to override intended default values, potentially granting unauthorized access or modifying application logic. For example, an attacker could set isAdmin: true to bypass access controls. The blast radius extends to any part of the application relying on the defu function and its default values, making it a significant security concern.
This vulnerability was publicly disclosed on 2026-04-04. While no active exploitation campaigns have been publicly reported, the ease of exploitation and the potential impact make it a high-priority concern. The vulnerability is not currently listed on CISA KEV. Public proof-of-concept code is likely to emerge, increasing the risk of widespread exploitation.
Applications built with Node.js that utilize the defu package for managing configuration or default values are at risk. This includes web applications, APIs, and backend services. Specifically, applications that parse user-supplied JSON data or load configuration files from untrusted sources are particularly vulnerable.
• nodejs / server:
npm audit defu• nodejs / supply-chain:
find . -name 'package.json' -print0 | xargs -0 grep '"defu": ["^6.1.5"']• generic web: Inspect application logs for unusual object properties or unexpected behavior after processing user input. Look for instances where default values are being unexpectedly overridden.
disclosure
漏洞利用状态
EPSS
0.04% (12% 百分位)
CISA SSVC
The primary mitigation for CVE-2026-35209 is to upgrade to defu version 6.1.5 or later, which includes a fix for the vulnerability. If upgrading is not immediately feasible, implement strict input sanitization on any user-supplied data passed to defu(). This involves validating and filtering input to prevent the injection of malicious proto payloads. Consider using a dedicated input validation library to ensure comprehensive protection. Additionally, review application code that utilizes defu to identify potential areas where prototype pollution could be exploited. After upgrading, confirm the fix by attempting to trigger the prototype pollution vulnerability with a crafted payload and verifying that the default values are not overridden.
Actualiza la librería 'defu' a la versión 6.1.5 o superior para mitigar la vulnerabilidad de contaminación de prototipos. Esto se soluciona reemplazando `Object.assign({}, defaults)` con object spread (`{ ...defaults }`), que evita la invocación del setter `__proto__`.漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-35209 是 defu 库中的一个原型污染漏洞，攻击者可以通过操纵 proto 属性来修改对象的原型。
如果您的项目使用了 6.1.5 之前的 defu 版本，并且将未经过滤的用户输入传递给 defu() 函数，那么您可能受到此漏洞的影响。
将 defu 升级到 6.1.5 或更高版本可以修复此漏洞。升级后，该库将防止原型污染攻击。
CVSS 向量