Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-61534: Yayson library can be tricked to alter core objects
CVE-2026-61534 · published 28 days ago
Summary
The Yayson JavaScript library used for handling JSON API data lets attackers craft specially named fields that change the fundamental Object template in a program. This can lead to crashes, incorrect behavior, or even bypassing security checks if the application relies on those objects. Update Yayson to version 4.3.0 or later to stop this risk.
What to do
- Update jede yayson to version 4.3.0.
- Update yayson to version 4.3.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | jede | yayson |
<= 4.2.0 Fix: upgrade to 4.3.0
|
| – | confetti | yayson | < 4.3.0 |
| npm | – | yayson |
<= 4.2.0 Fix: upgrade to 4.3.0
|
Original advisory text
yayson: Prototype pollution in Store/LegacyStore deserialization
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.
References
- https://github.com/confetti/yayson/security/advisories/GHSA-325j-mg25-8q58
- https://github.com/advisories/GHSA-325j-mg25-8q58
- https://github.com/confetti/yayson/pull/111
- https://github.com/confetti/yayson/commit/e460162d5a3ebac86424bead7424957c36f8df...
- https://github.com/confetti/yayson/releases/tag/v4.3.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61534... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61534 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1321Prototype Pollution
Timeline
Published14 Sep 2026
Updated12 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta