The unjs defu library allows recursive assignment of default properties. In versions before 6.1.5, passing unsanitized user input with a __proto__ key to defu() leads to prototype pollution due to the use of Object.assign({}, defaults) in the internal _defu function. Object.assign triggers the __proto__ setter, replacing the object's prototype with attacker-controlled values. This bypasses existing __proto__ key guards and results in polluted prototypes affecting the final merged object. The fix in version 6.1.5 replaces Object.assign with object spread syntax ({ ...defaults }), which uses [[DefineOwnProperty]] and avoids invoking the __proto__ setter, mitigating the vulnerability.

An attacker can manipulate the prototype of objects created by defu(), potentially altering application behavior by injecting or overriding properties inherited through the polluted prototype. The CVSS score of 7.5 (high severity) reflects that the vulnerability is remotely exploitable without privileges or user interaction, with no confidentiality impact but high integrity impact and no availability impact. There are no known exploits in the wild at this time.

Upgrade to defu version 6.1.5 or later, which replaces the vulnerable Object.assign usage with object spread syntax to prevent prototype pollution. Since no official patch link or advisory is provided, users should verify the version in use and update accordingly. Patch status is not yet confirmed via vendor advisory; check the vendor's official channels for the latest remediation guidance.