yayson vulnerabilities

1 known vulnerability in yayson from Confetti. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  yayson: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-61534Sep 14, 2026Confetti

  Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/leg