CVE-2026-8657 describes a prototype pollution vulnerability in the jsondiffpatch package affecting versions prior to 0.7.6. The vulnerability exists in the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs, where attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special prototype properties. This allows an attacker to modify Object.prototype, potentially leading to unexpected behavior or security issues in applications using the affected versions.

Successful exploitation allows an unauthenticated attacker to perform prototype pollution by injecting or modifying properties on Object.prototype. This can lead to application logic manipulation, denial of service, or other security impacts depending on how the polluted prototype is used by the application. The CVSS 4.0 score is 8.8 (high severity), indicating a significant risk with network attack vector, no privileges or user interaction required, and high impact on integrity.

No official patch or remediation level is currently confirmed for this vulnerability. Users should upgrade to jsondiffpatch version 0.7.6 or later once available. Until then, avoid using untrusted input with the vulnerable patch APIs. Monitor the vendor or package repository for official fixes and advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.