yayson: Prototype pollution in Store/LegacyStore deserialization

Published September 11, 2026 CVE-2026-61534

yayson: Prototype pollution in Store/LegacyStore deserialization. Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document.

Severity
CriticalCVSS 3.1 · 9.1 · github.com
Fix
Fixed in 4.3.0
Affected versions
4.2.0 or older
Weakness
CWE-1321Prototype Pollution
Affects
yayson

What to do

Run this in the application environment you want to check:

npm ls --all yayson

Update to 4.3.0 or later.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Open in FIRST.org calculator

References

View Original Source