Prototype Pollution in Yayson JSON:API Library (CVE-2026-61534)

What Happened

A prototype pollution vulnerability was identified in Yayson's Store and LegacyStore deserialization code (src/yayson/store.ts and src/yayson/legacy-store.ts). These components use attacker-controlled values from JSON:API documents — specifically the 'type', 'id', and relationship names — as keys in plain JavaScript object lookup tables without sanitization. A document that sets its type to '__proto__' causes the model cache to write directly into Object.prototype, with the attacker controlling the property name via the document's 'id' field and the value via its 'attributes'.

Technical Cause

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Because Store and LegacyStore use unsanitized JSON:API 'type', 'id', and relationship identifiers as object keys, special property names such as '__proto__', 'constructor', and 'prototype' are not filtered out. This allows a maliciously crafted document — including one supplied via an 'included' resource — to reach and modify Object.prototype. LegacyStore is also reachable when an application's configured types mapping resolves to '__proto__', providing an additional attack path.

Why It Matters

Prototype pollution affects all objects in a JavaScript process, since Object.prototype is shared globally. This can cause denial of service by corrupting shared object behavior, and can corrupt application logic in unpredictable ways. The advisory notes that further impact — such as authorization bypass or remote code execution — depends on whether the consuming application contains 'gadgets' (code paths that can be exploited once prototype properties are polluted). No such gadgets are confirmed in this advisory; the baseline impact described is denial of service and logic corruption.

Who Is Affected

Any application using the yayson npm package to deserialize JSON:API data from untrusted or external sources is potentially affected, since the vulnerability is triggered by processing attacker-supplied documents through Store or LegacyStore.

Affected Versions

All yayson versions from 0 up to and including 4.2.0 are affected.

Fixes and Mitigation

The vulnerability is fixed in yayson version 4.3.0. Organizations using yayson should upgrade to 4.3.0 or later.

Recommended Action

Update yayson to version 4.3.0 as soon as possible, particularly for applications that process JSON:API data originating from external or untrusted sources. After upgrading, review application logs for anomalous behavior that might indicate prior exploitation attempts, and audit any custom gadget code paths that could be affected by prototype pollution.