CVE-2026-8657 describes a prototype pollution vulnerability in the jsondiffpatch package affecting versions before 0.7.6. The vulnerability arises because the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs use attacker-controlled property names and path segments to traverse and modify objects without restricting access to special prototype properties such as __proto__ or constructor.prototype. This allows an attacker to manipulate Object.prototype, potentially leading to unexpected behavior or security issues in applications using the affected versions.

An attacker can perform prototype pollution by supplying malicious delta or JSON Patch documents, which can lead to modification of Object.prototype. This may cause security issues such as altering application logic, bypassing security controls, or causing denial of service. The CVSS 4.0 score is 8.8 (high severity), indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor vendor advisories for updates and consider avoiding use of affected versions until a fix is available.