CVE-2026-24001
1 advisory.
npm/diff CVE-2026-24001: low
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Action: Upgrade diff to 3.5.1 or later.
npm i diff@8.0.3npm i diff@5.2.2npm i diff@4.0.4npm i diff@3.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 8.0.3 | - |
| 5.0.0 | 5.2.2 | - |
| 4.0.0 | 4.0.4 | - |
| 0 | 3.5.1 | - |
Fixed versions
| 8.0.3 | 5.2.2 | 4.0.4 | 3.5.1 |
Sources
- osv: GHSA-73rr-hh4g-fpgx
- https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx
- https://nvd.nist.gov/vuln/detail/CVE-2026-24001
- https://github.com/kpdecker/jsdiff/issues/653
- https://github.com/kpdecker/jsdiff/pull/649
- https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5
- https://github.com/kpdecker/jsdiff
CVE-2026-24001 · published · modified · JSON