CVE-2026-8657 jsondiffpatch patch APIs are vulnerable to prototype pollution
Prototype pollution in jsondiffpatch allows attackers to modify Object.prototype via crafted patches, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8657?
CVE-2026-8657 is a high-severity vulnerability in jsondiffpatch, published on 16 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.
Weakness: CWE-1321
Which versions are affected by CVE-2026-8657?
2 open source packages ship an affected version, including jsondiffpatch.
| Package | Affected | Fixed in |
|---|---|---|
jsondiffpatch npm | All versions | 0.7.6 |
jsondiffpatch npm | All versions | 0.7.6 |
How do I fix CVE-2026-8657?
Upgrade jsondiffpatch to 0.7.6 or later.
Is CVE-2026-8657 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8657 exists.
Sources
Also known as GHSA-j4fx-xxwh-2485, MINI-3cxv-875p-rw48, MINI-4cmc-wxvv-7p58, MINI-6mcx-59xh-qh64, MINI-98pm-vvpq-8c9h, MINI-q845-f2vr-g2qf and 4 more.