Executive brief
yayson is a JavaScript library for serializing and deserializing JSON API data. A prototype pollution vulnerability in its Store and LegacyStore classes allows attackers to inject malicious properties into JavaScript object prototypes by sending specially crafted JSON API documents with type "__proto__". This can cause application-wide denial of service, logic corruption, or in some cases lead to authorization bypass or remote code execution depending on what gadgets are available in the consuming application.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the Store and LegacyStore classes of yayson versions ≤4.2.0. The vulnerable code uses plain JavaScript objects as lookup tables keyed by the type, id, and relationship names extracted directly from JSON:API documents without validation. An attacker can set type to "__proto__" (or cause LegacyStore to resolve to "__proto__" via a types mapping), which causes subsequent assignments to write directly onto Object.prototype. The attacker controls both the polluted property name (via id) and value (via the model's attributes). Pollution persists for the entire process lifetime. The malicious type can also arrive via included resources referenced by relationships, potentially bypassing any data.type allowlist. The guaranteed impact is process-wide denial of service or logic corruption; escalation to authorization bypass or RCE depends on gadgets in the consuming application. Fixed in version 4.3.0 using null-prototype lookup tables, validation rejecting __proto__/__constructor__/prototype as document-derived member names, Object.keys() iteration, and null-prototype normalization of caller-supplied caches.
Affected products
- confetti yayson <=4.2.0
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in version 4.3.0