CVE-2026-61534: 
JavaScript vulnerability analysis and mitigation

CVE-2026-61534 is a prototype pollution vulnerability in the Store and LegacyStore components of the yayson npm package, a JSON:API document deserializer. By supplying a JSON:API document with type: "__proto__", an unauthenticated remote attacker can write arbitrary properties onto Object.prototype, corrupting every object in the Node.js process. All versions up to and including 4.2.0 (covering all 3.x and 4.x releases) are affected; version 4.3.0 contains the fix. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Confetti Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). Store and LegacyStore use plain JavaScript objects as internal lookup tables keyed by the type, id, and relationship names parsed from a JSON:API document. Because type is used directly as an object key without sanitization, setting type to "__proto__" causes the assignment models["__proto__"][id] = model to write onto Object.prototype rather than a normal property. The attacker fully controls both the polluted key (id) and the polluted value (the model object, populated from attributes). The pollution persists for the entire process lifetime and can also be triggered via included resources in a relationship, bypassing any data.type allow-list; LegacyStore is additionally reachable when a configured types mapping resolves to "__proto__" (GitHub Advisory, Confetti Advisory).

Successful exploitation guarantees process-wide denial of service and logic corruption, as every object in the Node.js runtime inherits the attacker-injected properties from Object.prototype. Depending on the gadgets present in the consuming application, the impact can escalate to authorization bypass (e.g., security checks that rely on prototype-inherited properties) or remote code execution. Confidentiality impact is rated None in isolation, but integrity and availability are both rated High, reflecting the ability to corrupt application state and crash or destabilize the service (GitHub Advisory).

A public proof-of-concept is included in the official advisory and requires only a single Store.sync() call with a crafted JSON:API payload — no authentication, privileges, or user interaction are needed (Confetti Advisory). As of the advisory publication date (September 11, 2026), there is no evidence of in-the-wild exploitation or threat actor attribution. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been reported (GitHub Advisory).

1. Identify target: Locate a Node.js application that uses the yayson npm package (version ≤ 4.2.0) and exposes an endpoint that accepts and deserializes JSON:API documents via Store.sync() or LegacyStore.sync().
2. Craft malicious payload: Construct a JSON:API document with type set to "__proto__", an attacker-controlled id, and arbitrary attributes containing the properties to inject into Object.prototype:

{
  "data": {
    "type": "__proto__",
    "id": "polluted",
    "attributes": { "isAdmin": true }
  }
}

3. Deliver payload: Send the crafted document to the target endpoint (e.g., via HTTP POST with Content-Type: application/vnd.api+json).
4. Trigger pollution: The application calls Store.sync() on the received document; models["__proto__"]["polluted"] writes { isAdmin: true, id: "polluted" } onto Object.prototype, affecting every subsequently created object in the process.
5. Exploit gadgets: Depending on the application, leverage the polluted prototype property to bypass authorization checks (e.g., if (user.isAdmin)), cause logic errors, or trigger a crash for DoS. For RCE, identify application-specific gadgets that use prototype-inherited properties in dangerous operations (e.g., child_process.exec, template engines) (GitHub Advisory, Confetti Advisory).

• Network: Inbound HTTP requests with Content-Type: application/vnd.api+json (or similar) containing "type": "__proto__" or "type": "constructor" or "type": "prototype" in the JSON body; similar patterns in included arrays within JSON:API payloads.
• Logs: Application or web server access logs showing POST requests to JSON:API endpoints with unusually structured or oversized bodies; Node.js process errors or uncaught exceptions referencing Object.prototype or unexpected property inheritance.
• Process: Unexpected application behavior such as privilege escalation within the app, authorization checks returning incorrect results, or sudden process crashes/restarts following receipt of a JSON:API document.
• File System: No specific file artifacts expected, but unexpected files written by the Node.js process (e.g., shells, scripts) may indicate RCE via prototype pollution gadgets (GitHub Advisory).

Upgrade yayson to version 4.3.0, which fixes the issue by using null-prototype lookup tables, rejecting __proto__, constructor, and prototype as document-derived member names, switching to Object.keys() iteration, and normalizing caller-supplied caches. As an immediate workaround without upgrading, reject any incoming JSON:API documents whose type or relationship names equal __proto__, constructor, or prototype at the application layer before passing them to Store.sync(). Alternatively, run Node.js with the --disable-proto=throw flag to prevent prototype chain manipulation at the runtime level (Confetti Advisory, GitHub Advisory).