Compound WireCOMPOUND11 September 2026
yayson: Prototype pollution via deserialization
yayson, the npm JSON:API deserializer, lets a document with type "__proto__" write into Object.prototype through its Store and LegacyStore lookup tables. That makes process-wide denial of service and logic corruption possible even before any application-specific gadget turns it into something worse.