Critical, CVSS 9.1npmAmendedPublished
yayson: Prototype pollution in Store/LegacyStore deserialization
CVE-2026-61534 · GHSA-325j-mg25-8q58
- Affected
- npm yayson <= 4.2.0
- Fixed in
- 4.3.0· Vendor fix available
- Issue
- Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.1). The guaranteed impact is process-wide DoS / logic corruption; escalation to authorization bypass or RCE is dependent on gadgets in the consuming application. Affected / Patched - Affected: <= 4.2.0 (verified in 3.0.0 and 4.2.0; all 3.x and 4.x). - Patched: 4.3.0. Details type is a string value, untouched by JSON.parse, and is used directly as an object key: The attacker controls the polluted key (id) and value (the model, populated from attributes). Pollution persists for the process lifetime. The malicious type can also arrive via an included resource referenced by a relationship, bypassing any data.type allow-list. LegacyStore is additionally reachable when a…
Recommended action: Upgrade to 4.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.