CVE-2026-61534: Prototype Pollution in confetti yayson JSON:API Deserialization Engine
Vulnerability ID: CVE-2026-61534
CVSS Score: 9.1
Published: 2026-09-11
A critical prototype pollution vulnerability was discovered in the confetti yayson library prior to version 4.3.0. The library deserializes JSON:API structures into internal cache dictionaries mapped with standard JavaScript objects. An attacker can control the cache keys by supplying 'proto' in properties like type or id, modifying the prototype of all JavaScript objects process-wide.
TL;DR
Unauthenticated remote prototype pollution in confetti yayson allows process-wide logic corruption, Denial of Service, or Remote Code Execution via structured JSON:API documents.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1321
- Attack Vector: Network (AV:N)
- CVSS Score: 9.1 (Critical)
- Exploit Status: Proof of Concept (PoC) Available
- CISA KEV Status: Not Listed
- Impact: Integrity and Availability (High)
Affected Systems
- Applications running Node.js or browser environments deserializing JSON:API payloads with yayson versions <= 4.2.0
-
yayson: <= 4.2.0 (Fixed in:
4.3.0)
Code Analysis
Commit: e460162
Defend against prototype pollution by using null-prototype objects and checking for unsafe keys
Mitigation Strategies
- Upgrade confetti yayson package to version 4.3.0 or higher.
- Run Node.js process with --disable-proto=throw or --disable-proto=delete.
- Sanitize incoming client payloads at the gateway or middleware layer to drop proto, constructor, and prototype keys.
Remediation Steps:
- Identify all Node.js applications referencing yayson in package.json.
- Run npm install yayson@4.3.0 or yarn add yayson@4.3.0.
- Deploy perimeter validation rules to screen incoming application/vnd.api+json requests.
- Restart running application services with the V8 protection flag node --disable-proto=throw.
References
Read the full report for CVE-2026-61534 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)