CVE-2026-61534
Received Received - Intake

Prototype Pollution in Yayson Library

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-61534
EUVD
EUVD-2026-77579

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
yayson yayson 4.3.0
confetti yayson 4.3.0
confetti yayson to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61534 is a prototype pollution vulnerability in the Yayson library affecting versions 4.2.0 and earlier. It occurs during deserialization of JSON:API documents when the library uses attacker-controlled values like type, id, and relationship names as keys in plain-object lookup tables. When a document contains type: __proto__, it pollutes Object.prototype, affecting all objects in the process. This can lead to denial of service, logic corruption, authorization bypass, or code execution depending on the application's gadgets.

Detection Guidance

Detecting this vulnerability requires checking if your application uses the yayson library versions before 4.3.0. Inspect package.json for dependencies on yayson and verify the version. If using Node.js, run: npm list yayson. Check for any JSON:API documents containing type, id, or relationship names like __proto__, constructor, or prototype in requests or logs.

Impact Analysis

This vulnerability can cause process-wide denial of service, logic corruption, or authorization bypass. In severe cases, it may allow remote code execution if the consuming application has suitable gadgets. The impact depends on how the Yayson library is used in your application and what gadgets exist in the codebase.

Compliance Impact

Prototype pollution vulnerabilities like CVE-2026-61534 can lead to authorization bypass or code execution depending on application gadgets. This may violate GDPR's security principle (Article 32) requiring protection against unauthorized processing and HIPAA's integrity and access controls (45 CFR §164.312). Unauthorized data access or modification risks non-compliance.

Mitigation Strategies

Upgrade yayson to version 4.3.0 or later immediately. If upgrading is not possible, reject any JSON:API documents containing type or relationship names like __proto__, constructor, or prototype. Alternatively, run Node.js with the --disable-proto=throw flag to prevent prototype pollution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart