CVE-2026-8657: jsondiffpatch Prototype Pollution in patch APIs

CVE-2026-8657 · Severity: high · CVSS 8.2 · Published 2026-05-16

jsondiffpatch is a popular npm package used to generate and apply differences between JSON objects. The patch and JSON Patch formatting functions fail to restrict access to dangerous object properties like __proto__ and constructor.prototype. An attacker can craft malicious patch documents that pollute the JavaScript Object prototype, injecting properties that affect all objects in the application. This can lead to application crashes, unauthorized behavior modification, or serve as a stepping stone for privilege escalation.

Technologies: jsondiffpatch (npm). Vendors: npm.

Quick answers

Is CVE-2026-8657 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8657 being exploited in the wild.
How severe is CVE-2026-8657?
High severity, with a CVSS score of 8.2, published 16 May 2026.
Which products and versions are affected?
jsondiffpatch (npm) < 0.7.6, SEMVER:introduced=0,fixed=0.7.6.
Is there a fix for CVE-2026-8657?
Yes. jsondiffpatch (npm): upgrade to 0.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8657 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8657?
Check whether you run jsondiffpatch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsondiffpatch (npm): upgrade to 0.7.6 or later
    npm install jsondiffpatch@0.7.6

Technical details

The vulnerability is a prototype pollution flaw in the jsondiffpatch.patch(), jsondiffpatch/formatters/jsonpatch.patch(), and related APIs (unpatch and reverse). The root cause is insufficient input validation: attacker-controlled property names and path segments are used to traverse and modify objects without blocking special keys such as __proto__, constructor, or prototype. This allows an attacker to modify Object.prototype by supplying a crafted delta or JSON Patch document. The attack requires only network access and no authentication or user interaction. The fix, released in version 0.7.6, introduces an unsafe-keys blocklist (specifically __proto__) and adds a hasOwnProperty guard to prevent traversal into non-own properties like constructor.prototype.

Affected products

  • benjamine jsondiffpatch < 0.7.6

Identifiers

  • CVE-2026-8657
  • GHSA-j4fx-xxwh-2485

Timeline

  • 2026-05-16: disclosed
  • 2026-05-14: patched: Fix committed to repository before public disclosure
  • 2026-08-31: advisory: GitHub Advisory review completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.