CVE-2026-61534

yayson, an npm library for parsing JSON:API documents, is vulnerable to prototype pollution (CWE-1321) because Store and LegacyStore key their internal lookup tables with attacker-controlled 'type', 'id', and relationship-name strings from the document, using plain objects as the maps. A document whose type is '__proto__' — including one arriving as an 'included' resource referenced through a relationship, which bypasses any data.type allow-list — makes Store.sync() write onto Object.prototype, polluting every object in the Node.js process for its lifetime; LegacyStore is additionally reachable when a configured types mapping resolves to '__proto__'. An attacker gains at minimum process-wide denial of service or logic corruption, with escalation to authorization bypass or RCE possible only if the consuming application exposes exploitable gadgets. Any Node.js application using yayson 3.x or 4.x (<= 4.2.0) that deserializes untrusted JSON:API documents is affected. No public proof of concept or in-the-wild exploitation is known and the flaw is not in CISA KEV; severity is High (suggested CVSS v3.1 8.1 from the supplied vector, though the record also carries a 9.1 Critical rating).

What to do: Upgrade to yayson 4.3.0, which uses null-prototype lookup tables and rejects '__proto__', 'constructor', and 'prototype' as document-derived member names. As interim mitigation, reject documents whose type or relationship names are '__proto__', 'constructor', or 'prototype', and/or run Node with --disable-proto=throw. Audit whether attacker-controlled JSON:API payloads reach Store.sync()/LegacyStore.sync() and whether attacker-chosen polluted keys could influence security-sensitive logic in your application.