CVE-2026-8657 is a prototype pollution vulnerability affecting jsondiffpatch versions prior to 0.7.6. The issue arises in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs, where attacker-controlled property names and path segments are used to traverse and modify objects. This lack of restriction on special properties such as __proto__ or constructor.prototype enables modification of Object.prototype, potentially leading to unexpected behavior or security issues in applications using the affected package.

An attacker can exploit this vulnerability to perform prototype pollution, which may lead to modification of Object.prototype. This can cause unexpected application behavior, potentially enabling further attacks depending on the context in which the vulnerable package is used. The CVSS 4.0 score is 8.8, indicating a high severity vulnerability with network attack vector, no privileges or user interaction required, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted input with the vulnerable jsondiffpatch APIs or implement custom input validation to prevent prototype pollution vectors.