Prototype Pollution Vulnerability in Yayson Library by Confetti

CVE-2026-61534

What is CVE-2026-61534?

The Yayson library, used for serializing and reading JSON API data in JavaScript, is vulnerable due to improperly handled JSON:API type and relationship names in Store and LegacyStore components. This flaw allows an attacker to manipulate the names used for object lookups, leading to the ability to pollute the prototype of objects within the application. Specifically, if the attacker inputs a type of proto, it enables them to corrupt the Object.prototype, potentially resulting in denial of service, logic corruption, and in some cases, authorization bypass or code execution through suitable vulnerabilities in the host application. This issue was resolved in Yayson version 4.3.0.

References