The unjs defu library is affected by a critical prototype pollution vulnerability in versions prior to 6.1.5, which could allow unauthorized modification of object attributes.

This vulnerability is a prototype pollution flaw (CWE-1321) occurring because the library uses Object.assign to copy default properties. An unauthenticated attacker can supply a crafted payload containing a proto key to manipulate the prototype of objects, potentially altering application logic.

Successful exploitation of prototype pollution can lead to significant integrity issues, as an attacker may influence application behavior, bypass security controls, or trigger denial of service conditions. While the CVSS score of 7.5 indicates a high severity, the impact is primarily focused on data integrity within the application runtime. This vulnerability poses a risk to any service relying on defu to merge user-provided configuration or JSON data.

Immediate Action: Update the defu package to version 6.1.5 or later to replace the vulnerable object assignment logic with secure object spread syntax.

Proactive Monitoring: Inspect application logs for unusual JSON request structures or unexpected property changes in data objects that may indicate attempts to inject prototype pollution payloads.

Compensating Controls: Implement strict input validation and sanitization for all external data, especially JSON payloads, before passing them to merging functions.

Public Exploit Available: No

Given the ease of exploitability and the potential for deep application compromise, organizations should prioritize updating the defu dependency. Ensure all development teams are aware of the risk posed by merging untrusted input, and apply the patch to version 6.1.5 immediately to eliminate this attack vector.