CVE-2026-8657: jsondiffpatch Prototype Pollution Poses High Risk

The National Vulnerability Database has published details on CVE-2026-8657, a high-severity Prototype Pollution vulnerability affecting versions of the jsondiffpatch package prior to 0.7.6. This flaw, rated with a CVSS score of 8.2, stems from the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs.

Attackers can exploit this by injecting crafted delta or JSON Patch documents. The vulnerability arises because attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype. This allows for direct modification of Object.prototype, a critical vector for arbitrary code execution or denial-of-service in JavaScript applications.

For defenders, this is a clear-cut library update. Any application using jsondiffpatch is a potential target. The attacker’s calculus here is simple: find an exposed endpoint that processes jsondiffpatch data, then inject malicious __proto__ modifications to gain control. This isn’t theoretical; Prototype Pollution vulnerabilities consistently lead to serious compromises in real-world scenarios.