Yayson: Prototype pollution in the Store/LegacyStore deserialization (CVE-2026-61534) | HOL Guard CVE

Critical · CVSS 9.1CVE-2026-61534GHSA-325J-MG25-8Q58

Yayson: Prototype pollution in the Store/LegacyStore deserialization

Answer in brief

CVE-2026-61534 records a Critical severity (CVSS 9.1) vulnerability in Yayson: Prototype pollution in the Store/LegacyStore deserialization. The current sources do not mark it as known exploited. The current feed maps confetti/yayson (generic), yayson (npm), yayson (npm). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 14, 2026Updated Sep 14, 2026Source checked Sep 14, 2026First seen by HOL Sep 11, 2026Material review Sep 14, 2026

Upstream Advisory

Key facts

Risk: Critical · CVSS 9.1
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps confetti/yayson (generic), yayson (npm), yayson (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
confetti/yaysongeneric	< 4.3.0	Not reported
yaysonnpm	<=4.2.0	4.3.0
yaysonnpm	>=0 <4.3.0	4.3.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for confetti/yayson, yayson, yayson.
Review the reported fix. Update yayson to 4.3.0; yayson to 4.3.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.

Quoted source text, attributed separately from HOL analysis.