{"metadata": {"vulnerability": "CVE-2026-61534", "count": 16, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-07-10T16:27:03.093Z", "date_only": false, "value": "2026-07-10T16:27:03.093Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61534", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-11T22:11:38Z", "date_only": false, "value": "2026-09-11T22:11:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-325J-MG25-8Q58", "record": "GHSA-325J-MG25-8Q58", "field": "published"}, {"timestamp": "2026-09-11T22:11:38Z", "date_only": false, "value": "2026-09-11T22:11:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-325J-MG25-8Q58", "record": "GHSA-325J-MG25-8Q58", "field": "modified"}, {"timestamp": "2026-09-11T22:50:09.880Z", "date_only": false, "value": "2026-09-11T22:50:09.880865Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvbno2ezrf25", "record": "CVE-2026-61534", "field": "creation_timestamp", "uuid": "c45ef911-f3b9-4b6e-bf0b-6ebde40a4936", "content": "CVE-2026-61534 - yayson\nThe yayson data library versions up to 4.2.0 accept JSON input that can overwrite the basic template used for every object in the program. By sending a specially crafted document, an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#yayson #jede #npm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mvbno2ezrf25"}, {"timestamp": "2026-09-12T00:05:18.061Z", "date_only": false, "value": "2026-09-12T00:05:18.061998Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mvbruf6yp32g", "record": "CVE-2026-61534", "field": "creation_timestamp", "uuid": "e5dfc866-62b6-4609-8f90-8b0b9f4facae", "content": "Prototype pollution sails through while Prague waits for the memo\nPANIC 64% | Lag 0.0h | CVE-2026-61534 in yayson up to 4.2.0 lets a crafted JSON document overwrite the shared base template\n#AfterShockIndex\nREAD MORE", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mvbruf6yp32g"}, {"timestamp": "2026-09-12T00:35:03.612Z", "date_only": false, "value": "2026-09-12T00:35:03.612108Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/confetti/yayson/security/advisories/GHSA-325j-mg25-8q58", "record": "CVE-2026-61534", "field": "creation_timestamp", "uuid": "cb9c3d1c-6cbc-449b-b678-d8680d5d5723", "url": "https://github.com/confetti/yayson/security/advisories/GHSA-325j-mg25-8q58"}, {"timestamp": "2026-09-14T15:36:48.918Z", "date_only": false, "value": "2026-09-14T15:36:48.918Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61534", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-14T15:36:48.918Z", "date_only": false, "value": "2026-09-14T15:36:48.918Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61534", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-14T16:17:16.847Z", "date_only": false, "value": "2026-09-14T16:17:16.847", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61534", "record": "FKIE_CVE-2026-61534", "field": "published"}, {"timestamp": "2026-09-14T16:32:16.944Z", "date_only": false, "value": "2026-09-14T16:32:16.944218Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/880dc77a6d2d63a35f137e7b084bf95b", "record": "CVE-2026-61534", "field": "creation_timestamp", "uuid": "310fa769-b1a1-43fd-a81b-ef66c07e90c7", "content": "# CVE-2026-61534: CVE-2026-61534: Prototype Pollution in confetti yayson JSON:API Deserialization Engine\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61534\n\n## Summary\nA critical prototype pollution vulnerability was discovered in the confetti yayson library prior to version 4.3.0. The library deserializes JSON:API structures into internal cache dictionaries mapped with standard JavaScript objects. An attacker can control the cache keys by supplying '__proto__' in properties like type or id, modifying the prototype of all JavaScript objects process-wide.\n\n## TL;DR\nUnauthenticated remote prototype pollution in confetti yayson allows process-wide logic corruption, Denial of Service, or Remote Code Execution via structured JSON:API documents.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1 (Critical)\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **CISA KEV Status**: Not Listed\n- **Impact**: Integrity and Availability (High)\n\n## Affected Systems\n\n- Applications running Node.js or browser environments deserializing JSON:API payloads with yayson versions <= 4.2.0\n- **yayson**: <= 4.2.0 (Fixed in: `4.3.0`)\n\n## Mitigation\n\n- Upgrade confetti yayson package to version 4.3.0 or higher.\n- Run Node.js process with --disable-proto=throw or --disable-proto=delete.\n- Sanitize incoming client payloads at the gateway or middleware layer to drop __proto__, constructor, and prototype keys.\n\n**Remediation Steps:**\n1. Identify all Node.js applications referencing yayson in package.json.\n2. Run npm install yayson@4.3.0 or yarn add yayson@4.3.0.\n3. Deploy perimeter validation rules to screen incoming application/vnd.api+json requests.\n4. Restart running application services with the V8 protection flag node --disable-proto=throw.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/confetti/yayson/security/advisories/GHSA-325j-mg25-8q58)\n- [Fix Pull Request](https://github.com/confetti/yayson/pull/111)\n- [Fix Patch Commit](https://github.com/confetti/yayson/commit/e460162d5a3ebac86424bead7424957c36f8dff9)\n- [Release v4.3.0 Tag](https://github.com/confetti/yayson/releases/tag/v4.3.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61534) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/880dc77a6d2d63a35f137e7b084bf95b"}, {"timestamp": "2026-09-14T18:08:19.426Z", "date_only": false, "value": "2026-09-14T18:08:19.426981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipcssrur24", "record": "CVE-2026-61534", "field": "creation_timestamp", "uuid": "446440f5-0044-411b-8216-9f1b51aa4efd", "content": "\ud83d\udea8 CVE-2026-61534 \u2014 CVSS 9.1 CRITICAL\n\nYayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and Lega...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61534\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mvipcssrur24"}, {"timestamp": "2026-09-14T19:19:38.947Z", "date_only": false, "value": "2026-09-14T19:19:38.947733Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61534", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-14T19:19:38.947Z", "date_only": false, "value": "2026-09-14T19:19:38.947733Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61534", "record": "FKIE_CVE-2026-61534", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-14T19:19:45.499Z", "date_only": false, "value": "2026-09-14T19:19:45.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61534", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-14T19:19:45.499Z", "date_only": false, "value": "2026-09-14T19:19:45.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61534", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T17:51:56.193Z", "date_only": false, "value": "2026-09-30T17:51:56.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61534", "record": "FKIE_CVE-2026-61534", "field": "lastModified"}]}