CVE-2026-8657

Name of the Vulnerable Software and Affected Versions jsondiffpatch versions prior to 0.7.6

Description Prototype Pollution occurs when attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like proto or constructor.prototype, allowing modification of Object.prototype. This can affect application behavior throughout the entire Node.js process. The issue is triggered via the 'jsondiffpatch.patch()' and 'jsondiffpatch/formatters/jsonpatch.patch()' endpoints by supplying crafted delta or JSON Patch documents.

Recommendations Update to version 0.7.6 or later. Review applications that process untrusted JSON Patch input.