Description
Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "__proto__" writes onto Object.prototype, polluting every object in the process.
Recommendation
Update the yayson package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.2.0
- Patched version(s): 4.3.0
References
Could your website be exposed too?
SmartScanner can check your website for yayson: Prototype pollution in Store/LegacyStore deserialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
- Axios: Prototype Pollution Gadget in axios toFormData Options - CVE-2026-101909
- Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth - CVE-2026-101902
- @tmlmobilidade/utils has prototype pollution in its setValueAtPath - CVE-2026-45325
You might also like:
See something that needs correcting? Let us knowUpdated September 11, 2026