PT-2026-41422 · Npm · Jsondiffpatch

Yuki Matsuhashi · CVE-2026-8657 · Published 2026-05-16 · Updated 2026-05-17

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions jsondiffpatch versions prior to 0.7.6

Description Prototype Pollution occurs when attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like proto or constructor.prototype, allowing modification of Object.prototype. This can affect application behavior throughout the entire Node.js process. The issue is triggered via the 'jsondiffpatch.patch()' and 'jsondiffpatch/formatters/jsonpatch.patch()' endpoints by supplying crafted delta or JSON Patch documents.

Recommendations Update to version 0.7.6 or later. Review applications that process untrusted JSON Patch input.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-8657

Affected Products

Jsondiffpatch

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8657.json · Exploit
• 🔥 https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb · Exploit
• https://osv.dev/vulnerability/CVE-2026-8657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8657 · Security Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199 · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87 · Note
• https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168 · Note
• https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115 · Note
• https://twitter.com/infoflowcloud/status/2055867631308058685 · Twitter Post
• https://twitter.com/UpwindMDR/status/2055677036161622238 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990 · Note
• https://twitter.com/VulmonFeeds/status/2055541544011051226 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16732792 · Note
• https://twitter.com/CVEnew/status/2055866607675556020 · Twitter Post