{"action":"Upgrade jsondiffpatch to 0.7.6 or later.","affected":[{"fixed":"0.7.6","introduced":"0"}],"component":"jsondiffpatch","cve_ids":["CVE-2026-8657"],"ecosystem":"npm","epss":0.00378,"exploited":false,"fixed_versions":["0.7.6"],"ghsa_id":"GHSA-j4fx-xxwh-2485","id":"tcs_01M5KFWXED6F0CZHMGFXY55SP5","modified_at":"2026-09-10T03:51:05.988087881Z","published_at":"2026-05-16T06:30:29Z","references":["https://osv.dev/vulnerability/GHSA-j4fx-xxwh-2485","https://nvd.nist.gov/vuln/detail/CVE-2026-8657","https://github.com/benjamine/jsondiffpatch/commit/381c0125efab49f6f0dbc08317d01d55717672af","https://gist.github.com/yuki-matsuhashi/e570fb1579ae1f3190059b622b0473fb","https://github.com/benjamine/jsondiffpatch","https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L107-L115","https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/filters/nested.ts%23L82-L87","https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L146-L168","https://github.com/benjamine/jsondiffpatch/blob/96112c35a98f9201dd75d67fcee68a952c79e2fe/packages/jsondiffpatch/src/formatters/jsonpatch-apply.ts%23L171-L199","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16732792","https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-16322990"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-j4fx-xxwh-2485","url":"https://osv.dev/vulnerability/GHSA-j4fx-xxwh-2485"}],"summary":"jsondiffpatch patch APIs are vulnerable to prototype pollution"}