What’s Vulnerable › Vulnerabilities

CVE-2026-8657

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-16 · updated 2026-07-05
• Weakness: CWE-1321

Description

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

Affected products

• jsondiffpatch: before 0.7.6 — fixed in 0.7.6
• org.webjars.npm:jsondiffpatch: all versions

How to fix

Upgrade to a fixed version: jsondiffpatch 0.7.6. Check the vendor advisory for mitigations.

References

• https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199
• https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16732792
• https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990
• https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb

Get alerted when CVE-2026-8657 or the next vulnerability affects your stack