CVE-2026-61534: Critical severity npm/yayson vulnerability
Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process.
Severity Suggested CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.1). The guaranteed impact is process-wide DoS / logic corruption; escalation to authorization bypass or RCE is dependent on gadgets in the consuming application.
Affected / Patched - Affected: <= 4.2.0 (verified in 3.0.0 and 4.2.0; all 3.x and 4.x). - Patched: 4.3.0.
Details type is a string value, untouched by JSON.parse, and is used directly as an object key: js if (!models[type]) models[type] = {} // models["proto"] is Object.prototype → skipped if (!models[type][id]) models[type][id] = model // → Object.prototype[id] = model The attacker controls the polluted key (id) and value (the model, populated from attributes). Pollution persists for the process lifetime. The malicious type can also arrive via an included resource referenced by a relationship, bypassing any data.type allow-list. LegacyStore is additionally reachable when a configured types mapping resolves to "proto".
Proof of concept js const { Store } = require('yayson')() new Store().sync({ data: { type: 'proto', id: 'polluted', attributes: { x: 1 } } }) console.log(({}).polluted) // { x: 1, id: 'polluted' } ← Object.prototype polluted
Workarounds Reject documents whose type or relationship names are proto, constructor, or prototype, or run Node with --disable-proto=throw.
Fix Null-prototype lookup tables, rejection of proto/constructor/prototype as document-derived member names, Object.keys() iteration, and null-prototype normalization of caller-supplied caches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/yaysonto a version that resolves this vulnerability.Fixed in 4.3.0 - Upgrade
Upgrade
yaysonto a version that resolves this vulnerability.Fixed in 4.3.0 - Configuration
Reject documents whose `type` or relationship names are `__proto__`, `constructor`, or `prototype` (these names must not be used as object keys). Also reject `type` values in `included` resources referenced by relationships, since they can bypass any `data.type` allow-list.
yayson Store/LegacyStore JSON:API document handling Document-derived member names = reject __proto__/constructor/prototype for `type` and relationship names - Compensating control
Run Node with the flag `--disable-proto=throw` to reject `__proto__` document-derived member names.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using yayson 3.x or 4.x through 4.2.0 are affected. The issue was verified in versions 3.0.0 and 4.2.0, and version 4.3.0 is patched.
What does an attacker need to exploit this?
An attacker needs to cause the application to process a crafted JSON:API document containing a resource type of "__proto__". No privileges or user interaction are required according to the supplied CVSS vector.
Can validating only the top-level resource type prevent exploitation?
No. A malicious type can be supplied through an included resource referenced by a relationship, bypassing an allow-list that checks only data.type. Validation must account for resources arriving through included content as well.
What should be done if upgrading cannot happen immediately?
Reject JSON:API input containing "__proto__" in resource type fields before it reaches the store, including included resources. Also validate attacker-controlled identifiers and relationship names used as lookup keys.
How can an affected process be investigated?
The pollution writes an attacker-controlled id and model onto Object.prototype and remains for the lifetime of the process. Inspect the running process for unexpected Object.prototype properties, particularly keys corresponding to untrusted JSON:API resource ids.