Prototype Pollution in yayson Store/LegacyStore Could Enable Process-Wide DoS or Logic Corruption

A newly published GitHub Security Advisory (GHSA-325j-mg25-8q58, CVE-2026-61534) discloses a prototype pollution vulnerability in yayson, an npm JSON:API deserialization library, affecting versions <= 4.2.0 (verified in 3.0.0 and 4.2.0; all 3.x/4.x). The fix ships in 4.3.0.

What was reported

According to the advisory, yayson's Store and LegacyStore classes use plain JavaScript objects as internal lookup tables, keyed directly by the type, id, and relationship names taken from an incoming JSON:API document. Because type is a string value untouched by JSON.parse, an attacker-supplied document with type: "__proto__" is used as a live object key, causing subsequent writes (keyed by attacker-controlled id, with attacker-controlled attributes as the value) to land on Object.prototype itself. The advisory notes this pollution persists for the lifetime of the process, that the malicious type can also arrive via an included resource referenced by a relationship (bypassing a data.type allow-list), and that LegacyStore is separately reachable via a configured types mapping that resolves to "__proto__". A working proof-of-concept is included in the advisory. The suggested CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.1), though the feed reports 9.1 — treat the exact score as advisory-source-dependent and confirm against the GHSA record.

Why it matters

The advisory characterizes the guaranteed impact as process-wide denial of service or logic corruption in any application that deserializes untrusted JSON:API documents with yayson. Escalation beyond that — to authorization bypass or remote code execution — is explicitly described as dependent on exploitable gadgets elsewhere in the consuming application, not guaranteed by yayson alone. Because prototype pollution corrupts shared object behavior for the entire Node.js process, a single malicious request can silently affect unrelated logic (auth checks, config defaults, template rendering) for every subsequent request until restart.

What defenders should watch for or do now

• Inventory whether yayson is a direct or transitive dependency and check the resolved version against <= 4.2.0; upgrade to 4.3.0 where affected.
• As an interim mitigation, per the advisory: reject any JSON:API document (including included resources) whose type or relationship names are __proto__, constructor, or prototype before it reaches yayson.
• Consider running Node with --disable-proto=throw as a defense-in-depth control for services parsing untrusted JSON:API input.
• At a hunting level, look for anomalous application behavior consistent with prototype pollution — unexplained config/logic changes, crashes, or auth anomalies correlated with JSON:API request bodies containing __proto__, constructor, or prototype as a type or relationship value.
• Review WAF/input-validation layers to ensure they inspect nested included arrays, not just top-level data.type, since the advisory notes the allow-list bypass path.

This is a same-day advisory and details may be refined as the ecosystem responds; there is no known ransomware campaign use reported at this time. For the full technical write-up and proof-of-concept, see the original GHSA advisory: GHSA-325j-mg25-8q58.