Junglewise Threat Intelligence

CVE-2026-8657: jsondiffpatch Prototype Pollution in patch APIs

CVE-2026-8657 · Severity: high · CVSS 8.2 · Published 2026-05-16

Technologies: jsondiffpatch (npm). Vendors: npm.

Executive brief

jsondiffpatch is a popular npm package used to generate and apply differences between JSON objects. The patch and JSON Patch formatting functions fail to restrict access to dangerous object properties like __proto__ and constructor.prototype. An attacker can craft malicious patch documents that pollute the JavaScript Object prototype, injecting properties that affect all objects in the application. This can lead to application crashes, unauthorized behavior modification, or serve as a stepping stone for privilege escalation.

Technical details

The vulnerability is a prototype pollution flaw in the jsondiffpatch.patch(), jsondiffpatch/formatters/jsonpatch.patch(), and related APIs (unpatch and reverse). The root cause is insufficient input validation: attacker-controlled property names and path segments are used to traverse and modify objects without blocking special keys such as __proto__, constructor, or prototype. This allows an attacker to modify Object.prototype by supplying a crafted delta or JSON Patch document. The attack requires only network access and no authentication or user interaction. The fix, released in version 0.7.6, introduces an unsafe-keys blocklist (specifically __proto__) and adds a hasOwnProperty guard to prevent traversal into non-own properties like constructor.prototype.

Affected products

  • benjamine jsondiffpatch < 0.7.6

Timeline

  • 2026-05-16: disclosed
  • 2026-05-14: patched: Fix committed to repository before public disclosure
  • 2026-08-31: advisory: GitHub Advisory review completed

References

Related threats