CVE-2026-61534
CRITICALCVE-2026-61534 is a critical-severity (CVSS 9.1) CWE-1321 vulnerability in yayson. O3 Security confirms whether CVE-2026-61534 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
yayson: Prototype pollution in Store/LegacyStore deserialization
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-61534.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
yaysonnpmDescription
Summary
Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "__proto__" writes onto Object.prototype, polluting every object in the process.
Severity
Suggested CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.1). The guaranteed impact is process-wide DoS / logic corruption; escalation to authorization bypass or RCE is dependent on gadgets in the consuming application.
Affected / Patched
- Affected:
<= 4.2.0(verified in3.0.0and4.2.0; all 3.x and 4.x). - Patched:
4.3.0.
Details
type is a string value, untouched by JSON.parse, and is used directly as an object key:
if (!models[type]) models[type] = {} // models["__proto__"] is Object.prototype → skipped
if (!models[type][id]) models[type][id] = model // → Object.prototype[id] = model
The attacker controls the polluted key (id) and value (the model, populated from attributes). Pollution persists for the process lifetime. The malicious type can also arrive via an included resource referenced by a relationship, bypassing any data.type allow-list. LegacyStore is additionally reachable when a configured types mapping resolves to "__proto__".
Proof of concept
const { Store } = require('yayson')()
new Store().sync({ data: { type: '__proto__', id: 'polluted', attributes: { x: 1 } } })
console.log(({}).polluted) // { x: 1, id: 'polluted' } ← Object.prototype polluted
Workarounds
Reject documents whose type or relationship names are __proto__, constructor, or prototype, or run Node with --disable-proto=throw.
Fix
Null-prototype lookup tables, rejection of __proto__/constructor/prototype as document-derived member names, Object.keys() iteration, and null-prototype normalization of caller-supplied caches.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | yayson | all versions | 4.3.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yayson. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update yayson to 4.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61534 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-61534 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-61534. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-61534 in your dependencies?
O3 detects CVE-2026-61534 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.