CVE-2026-8657 – Apache jsondiffpatch Prototype Pollution Vulnerability

CVE ID :CVE-2026-8657

Published : May 16, 2026, 6:16 a.m. | 1 hour, 41 minutes ago

Description :Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

Severity: 8.2 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…