{"action":"Upgrade diff to 3.5.1 or later.","affected":[{"fixed":"8.0.3","introduced":"6.0.0"},{"fixed":"5.2.2","introduced":"5.0.0"},{"fixed":"4.0.4","introduced":"4.0.0"},{"fixed":"3.5.1","introduced":"0"}],"component":"diff","cve_ids":["CVE-2026-24001"],"ecosystem":"npm","epss":0.00616,"exploited":false,"fixed_versions":["8.0.3","5.2.2","4.0.4","3.5.1"],"ghsa_id":"GHSA-73rr-hh4g-fpgx","id":"tcs_01M5KF8NMWT7WHZWHEAZRSSED3","modified_at":"2026-09-10T03:50:32.703687207Z","published_at":"2026-01-14T21:34:12Z","references":["https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://nvd.nist.gov/vuln/detail/CVE-2026-24001","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-73rr-hh4g-fpgx","url":"https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx"}],"summary":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch"}