Which versions of jsondiffpatch are affected by CVE-2026-8657?

jsondiffpatch, a widely-used JavaScript library for JSON document diffing, contains a prototype pollution vulnerability that allows attackers to corrupt global JavaScript object behavior in…. A patch is available.

How to fix or mitigate CVE-2026-8657?

Within 24 hours: Inventory all applications and dependencies using jsondiffpatch and assess whether they process untrusted diff input from end-users or external sources. Within 7 days: Upgrade jsondiffpatch to version 0.7.6 or later across all affected applications and conduct regression testing before production deployment. Within 30 days: Implement automated dependency scanning and establish a policy requiring immediate patching of HIGH and above CVE severity vulnerabilities within 7 days of release.

jsondiffpatch CVE-2026-8657

Q: What is the CVSS score of CVE-2026-8657?

CVE-2026-8657 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30670 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-05-16 snyk

GHSA-j4fx-xxwh-2485

Prototype Pollution Information Disclosure Jsondiffpatch

7.8

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (snyk) · only source for this CVE.

CVSS VectorVendor: snyk

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 16, 2026 - 06:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 16, 2026 - 06:22 vuln.today

cvss_changed

CVSS changed

May 16, 2026 - 06:22 NVD

8.2 (HIGH) 7.8 (HIGH)

Patch available

May 16, 2026 - 06:01 EUVD

Source Code Evidence Fetched

May 16, 2026 - 05:42 vuln.today

Analysis Generated

May 16, 2026 - 05:42 vuln.today

DescriptionCVE.org

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

AnalysisAI

Prototype pollution in the jsondiffpatch JavaScript library before 0.7.6 allows attackers to modify Object.prototype by supplying crafted delta documents to jsondiffpatch.patch() or JSON Patch documents to the jsonpatch formatter's patch() API. Because attacker-controlled key names and JSON Pointer path segments were used to traverse and mutate objects without filtering __proto__, constructor, or prototype, any application that feeds untrusted diffs into the library can have global object behavior tampered with. A public POC exists in the Snyk advisory and an accompanying gist, but there is no public exploit identified at time of analysis (not on CISA KEV).

Technical ContextAI

jsondiffpatch is a widely used Node.js/browser library (npm package 'jsondiffpatch') for computing and applying JSON deltas, including an RFC 6902 JSON Patch formatter. The vulnerability is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, 'Prototype Pollution'). Two code paths are at fault: packages/jsondiffpatch/src/filters/nested.ts, where the patch/reverse filters iterated delta keys and indexed into context.left[name] without rejecting __proto__ or restricting traversal to own properties (so a delta key chain like constructor.prototype walked through the inherited constructor into Object.prototype); and packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts, where parsePathFromRFC6902 split a JSON Pointer string into segments that were used unchecked as property accessors. The fix introduces an UNSAFE_KEYS set ({__proto__, constructor, prototype} for JSON Patch paths, {__proto__} for delta filters combined with hasOwnProperty guards on left) so unsafe segments are skipped or rejected. The single affected CPE is cpe:2.3:a:n/a:jsondiffpatch:*:*:*:*:*:*:*:* covering versions 0 < 0.7.6.

RemediationAI

Upgrade the jsondiffpatch dependency to 0.7.6 or later (vendor-released patch: 0.7.6), which adds an UNSAFE_KEYS filter and an own-property guard in packages/jsondiffpatch/src/filters/nested.ts and rejects __proto__, constructor, and prototype segments in packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts (see https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af and https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990). If immediate upgrade is not possible, do not pass untrusted delta or JSON Patch documents into jsondiffpatch.patch() or jsondiffpatch/formatters/jsonpatch.patch(); pre-validate inputs by recursively rejecting any object key or JSON Pointer segment equal to __proto__, constructor, or prototype before applying, accepting that this validation must mirror the library's traversal exactly or risk bypass. As broader hardening, run Node with --disable-proto=delete (which removes the __proto__ accessor entirely and may break libraries that rely on it) or freeze Object.prototype at process startup with Object.freeze(Object.prototype) (which can break code that intentionally augments built-in prototypes); both are application-wide changes and should be tested before rollout.