CVE-2026-8657
CVE-2026-8657
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.
CVSS 8.8 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
jsondiffpatch
- Versions
- ≥ 0, < 0.7.6: Affected (semver)
Update to 0.7.6
org.webjars.npm:jsondiffpatch
- Versions
- ≥ 0: Affected (semver)
No fix published
jsondiffpatch npm
- Affected ranges
- SEMVER: < 0.7.6
Update to 0.7.6
Original sources
- https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16732792
- https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb
- https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87
- https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115
- https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168
- https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199
- https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af
- https://nvd.nist.gov/vuln/detail/CVE-2026-8657