Skip to content
OpenAdvisories

Package · npm

defu

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2026-35209

    defu: Prototype pollution via `__proto__` key in defaults argument

    defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument…

    unjs defu defu npm