PT-2026-41422 · Npm · Jsondiffpatch

Yuki Matsuhashi · Published 2026-05-16 · Updated 2026-05-16 · CVE-2026-8657

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions jsondiffpatch versions prior to 0.7.6

Description Prototype Pollution occurs when attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like proto or constructor.prototype, allowing modification of Object.prototype. This can be triggered by supplying crafted delta or JSON Patch documents through the 'jsondiffpatch.patch()' and 'jsondiffpatch/formatters/jsonpatch.patch()' APIs.

Recommendations Update to version 0.7.6 or later.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-8657

Affected Products

Jsondiffpatch

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-8657 · Security Note
• https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115 · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87 · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168 · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199 · Note
• https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb · Note
• https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990 · Note
• https://twitter.com/VulmonFeeds/status/2055541544011051226 · Twitter Post