PatchSiren

Unjs CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Unjs CVE published 2026-04-06

CVE-2026-35209

CVE-2026-35209 is a high-severity vulnerability in Unjs Defu, a software that allows users to assign default properties recursively. The vulnerability, caused by a flawed use of Object.assign, allows attackers to pollute the prototype of objects, potentially leading to security issues. The vulnerability was patched in version 6.1.5. The internal _defu function used Object.assign({}, defaults) to copy the [truncated]