chore(deps): update pnpm.catalog.prod defu to v6.1.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
defu	6.1.4 → 6.1.5

---

defu: Prototype pollution via __proto__ key in defaults argument

CVE-2026-35209 / GHSA-737v-mqg7-c878

More information

Details

Impact

Applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to defu() are vulnerable to prototype pollution.

A crafted payload containing a __proto__ key can override intended default values in the merged result:

import { defu } from 'defu'

const userInput = JSON.parse('{"__proto__":{"isAdmin":true}}')
const config = defu(userInput, { isAdmin: false })

config.isAdmin // true — attacker overrides the server default

Root Cause

The internal _defu function used Object.assign({}, defaults) to copy the defaults object. Object.assign invokes the __proto__ setter, which replaces the resulting object's [[Prototype]] with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing __proto__ key guard in the for...in loop and land in the final result.

Fix

Replace Object.assign({}, defaults) with object spread ({ ...defaults }), which uses [[DefineOwnProperty]] and does not invoke the __proto__ setter.

Affected Versions

<= 6.1.4

Credits

Reported by @​BlackHatExploitation

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878
• https://nvd.nist.gov/vuln/detail/CVE-2026-35209
• https://github.com/unjs/defu/pull/156
• https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29
• https://github.com/unjs/defu/releases/tag/v6.1.5
• https://github.com/advisories/GHSA-737v-mqg7-c878

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

defu: Prototype pollution via __proto__ key in defaults argument

CVE-2026-35209 / GHSA-737v-mqg7-c878

More information

Details

Impact

Applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to defu() are vulnerable to prototype pollution.

A crafted payload containing a __proto__ key can override intended default values in the merged result:

import { defu } from 'defu'

const userInput = JSON.parse('{"__proto__":{"isAdmin":true}}')
const config = defu(userInput, { isAdmin: false })

config.isAdmin // true — attacker overrides the server default

Root Cause

The internal _defu function used Object.assign({}, defaults) to copy the defaults object. Object.assign invokes the __proto__ setter, which replaces the resulting object's [[Prototype]] with attacker-controlled values. Properties inherited from the polluted prototype then bypass the existing __proto__ key guard in the for...in loop and land in the final result.

Fix

Replace Object.assign({}, defaults) with object spread ({ ...defaults }), which uses [[DefineOwnProperty]] and does not invoke the __proto__ setter.

Affected Versions

<= 6.1.4

Credits

Reported by @​BlackHatExploitation

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878
• https://nvd.nist.gov/vuln/detail/CVE-2026-35209
• https://github.com/unjs/defu/pull/156
• https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29
• https://github.com/unjs/defu
• https://github.com/unjs/defu/releases/tag/v6.1.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

unjs/defu (defu)

v6.1.5

Compare Source

compare changes

🩹 Fixes

• Prevent prototype pollution via __proto__ in defaults (#​156)
• Ignore inherited enumerable properties (11ba022)

🏡 Chore

• Add tea.yaml (70cffe5)
• Update repo (23cc432)
• Fix typecheck (89df6bb)

✅ Tests

• Add more tests for plain objects (b65f603)

🤖 CI

• Bump node (9237d9c)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	actions-kit	47ef81e	May 12 2026, 05:49 PM