CVE-2026-61534: Yayson JSON API Library DOS Vulnerability

CVE-2026-61534 Overview

CVE-2026-61534 is a prototype pollution vulnerability in Yayson, a JavaScript library for serializing and reading JSON:API data. The flaw affects all versions prior to 4.3.0. The Store and LegacyStore components use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables. A document with type set to __proto__ causes model-cache writes to modify Object.prototype globally across the Node.js process. The issue is tracked as [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact
Process-wide prototype pollution can cause denial of service, logic corruption, and — with suitable application gadgets — authorization bypass or code execution.

Affected Products

Yayson library versions prior to 4.3.0
Applications consuming Yayson Store for JSON:API document parsing
Applications using Yayson LegacyStore with types mappings that resolve to __proto__

Discovery Timeline

2026-09-14 - CVE-2026-61534 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-61534

Vulnerability Analysis

Yayson deserializes JSON:API documents into internal model caches keyed by document-supplied strings. In src/yayson/store.ts and src/yayson/legacy-store.ts, the library writes to plain JavaScript objects using untrusted type and id values as property keys. When an attacker supplies type equal to __proto__, subsequent writes traverse the object prototype chain and mutate Object.prototype itself. The attacker controls both the polluted property name (through id) and its value (through attributes).

The attack surface extends beyond top-level resources. A malicious type can be delivered through an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths that reach the vulnerable sink.

Root Cause

The root cause is the use of ordinary JavaScript objects as lookup tables combined with the absence of key validation. Assignments of the form cache[type][id] = value allow adversaries to write arbitrary properties onto Object.prototype. Every subsequently created object in the process inherits the polluted property.

Attack Vector

Exploitation requires only that the application feed an attacker-influenced JSON:API document into Store.sync() or the equivalent LegacyStore method. No authentication is required when the parser is reachable through a public API endpoint. The result is process-wide state corruption; downstream impact depends on gadgets present in the consuming application, ranging from denial of service to authorization bypass.

typescript

// Security patch — src/yayson/safe.ts (new file)
// Source: https://github.com/confetti/yayson/commit/e460162d5a3ebac86424bead7424957c36f8dff9

/**
 * Defenses against prototype pollution, since yayson keys lookup tables and
 * model objects by strings from untrusted documents (`type`, `id`, member
 * names). Caches use null-prototype objects, and "__proto__"/"constructor"/
 * "prototype" are rejected as member names.
 */

/** Null-prototype lookup table (Object.create(null), never obj.__proto__). */
export function safeObject<T extends object>(): T {
  return Object.create(null) as T
}

const UNSAFE_KEYS = new Set<string>(['__proto__', 'constructor', 'prototype'])

export function isUnsafeKey(key: string): boolean {
  return UNSAFE_KEYS.has(key)
}

The patch introduces null-prototype lookup tables via Object.create(null) and rejects the dangerous member names __proto__, constructor, and prototype. The corresponding change in src/yayson/legacy-store.ts imports safeObject and isUnsafeKey to sanitize cache writes.

Detection Methods for CVE-2026-61534

Indicators of Compromise

JSON:API request bodies containing "type": "__proto__", "type": "constructor", or "type": "prototype" at the top level or within included arrays
Relationship objects whose member names equal __proto__, constructor, or prototype
Unexpected properties appearing on objects across unrelated code paths after JSON:API parsing
Node.js process anomalies such as sudden logic errors, altered default values, or crashes after handling external JSON:API payloads

Detection Strategies

Inspect ingress web application firewall or API gateway logs for JSON:API payloads containing reserved JavaScript property names in type or relationship fields
Add runtime assertions that verify Object.prototype remains unmodified after processing untrusted input
Perform software composition analysis to identify services depending on Yayson versions prior to 4.3.0

Monitoring Recommendations

Enable structured logging on JSON:API deserialization boundaries to capture rejected or anomalous type values
Alert on unhandled exceptions originating from downstream code that reads inherited properties unexpectedly
Track dependency manifests in CI to fail builds when vulnerable Yayson versions are detected

How to Mitigate CVE-2026-61534

Immediate Actions Required

Upgrade Yayson to version 4.3.0 or later in all applications and services
Audit code paths that pass user-controlled JSON:API documents into Store.sync() or LegacyStore
Review any types mapping configurations for values that could resolve to __proto__, constructor, or prototype

Patch Information

The fix is available in Yayson 4.3.0. See the GitHub Security Advisory GHSA-325j-mg25-8q58, the remediation commit, Pull Request #111, and the 4.3.0 release notes.

Workarounds

Validate and reject inbound JSON:API documents whose type, id, or relationship names equal __proto__, constructor, or prototype before invoking Yayson
Deploy Node.js with Object.freeze(Object.prototype) at process startup to block prototype writes
Place a schema-validating proxy in front of services that accept JSON:API traffic

bash

# Upgrade Yayson to the patched release
npm install yayson@^4.3.0

# Verify installed version
npm ls yayson

# Audit dependencies for the vulnerable range
npm audit --production