CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization
Prototype pollution in Yayson allows attackers to corrupt Object.prototype via malicious JSON:API data, potentially leading to denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61534?
CVE-2026-61534 is a critical unsafe deserialization vulnerability in confetti yayson, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.
Weakness: CWE-1321
Which versions are affected by CVE-2026-61534?
2 open source packages ship an affected version, including yayson.
| Package | Affected | Fixed in |
|---|---|---|
yayson npm | All versions | 4.3.0 |
yayson npm | All versions | 4.3.0 |
How do I fix CVE-2026-61534?
Upgrade yayson to 4.3.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-61534 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61534 exists.
Sources
Also known as GHSA-325j-mg25-8q58.