CVE-2026-8657 is a prototype pollution vulnerability affecting jsondiffpatch versions prior to 0.7.6. The issue arises in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs, where attacker-controlled property names and path segments are used to traverse and modify objects without proper restrictions. This allows modification of Object.prototype, which can lead to unexpected behavior or security issues in applications using the affected library. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, but high impact on integrity.

An attacker can exploit this vulnerability remotely without authentication or user interaction to perform prototype pollution by sending crafted delta or JSON Patch documents. This can result in modification of Object.prototype, potentially leading to application logic manipulation, denial of service, or other security impacts depending on how the affected application uses the jsondiffpatch library. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted input with the vulnerable jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. Monitor vendor channels for updates regarding patches or official mitigations.