defu allows developers to merge default values into objects recursively. Before version 6.1.5, an attacker could send a payload containing a __proto__ key as part of the defaults argument. The library copied defaults with Object.assign, which triggered the __proto__ setter and replaced the prototype of the result object. This prototype pollution can allow attackers to inject arbitrary properties into the Object.prototype, potentially affecting all objects created thereafter and leading to logic bypasses or other unintended behavior.

The affected product is the JavaScript library defu, maintained by unjs. All releases prior to 6.1.5 are vulnerable. Applications that use defu to merge user supplied data, such as parsed JSON bodies or configuration files from untrusted sources, are at risk unless they have removed the ability to pass raw user data to defu.

The CVSS base score is 7.5, indicating a high potential for severe impact if exploited. The CVE is not listed in KEV and no EPSS score is available. Attacks would require sending crafted input to a defu invocation, which is likely possible via an HTTP endpoint or configuration import. Once the prototype is polluted, any subsequent object created in the same process can inherit the injected properties, allowing attackers to alter runtime behavior or bypass security checks.