Prototype Pollution Vulnerability in jsondiffpatch by Benjamin

CVE-2026-8657

What is CVE-2026-8657?

Versions of the jsondiffpatch package prior to 0.7.6 are susceptible to prototype pollution. This vulnerability arises from unsafe handling in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs, where maliciously crafted delta or JSON Patch documents can exploit attacker-controlled property names and path segments. This allows attackers to traverse and modify objects, compromising the integrity of Object.prototype and enabling unauthorized modifications to the application’s behavior.

References