defu vulnerabilities

1 known vulnerability in defu from Unjs. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  defu: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-35209Apr 6, 2026Unjs

  defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument