CVE-2020-8268: Prototype pollution in json8-merge-patch
Summary
CVE-2020-8268: Prototype pollution in json8-merge-patch. Affects json8-merge-patch versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json8-merge-patch npm package is a library that provides functionality for merging JSON objects using the JSON Merge Patch format. It is commonly used in Node.js applications to handle JSON data manipulation and merging. However, versions prior to 1.0.3 are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in json8-merge-patch allows attackers to exploit prototype pollution, which is a type of vulnerability that enables them to inject or modify methods and properties of the global object constructor. This can lead to various security issues, such as remote code execution, data tampering, or denial of service attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.0.5 as of 23 Oct 2026
npm install json8-merge-patch@1.0.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.3
This is the first release that contains the fix.
npm install json8-merge-patch@1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not feasible at the moment, a temporary workaround is to avoid using untrusted or user-controlled data when using the json8-merge-patch library. By validating and sanitizing input data, you can reduce the risk of prototype pollution attacks. Here is an example of input validation using a simple JavaScript function:
function validateInput(data) {
if (typeof data === 'object' && !Array.isArray(data)) {
return data;
}
return {};
}
Conclusion
In conclusion, the json8-merge-patch npm package prior to version 1.0.3 is vulnerable to prototype pollution. It is crucial to update the package to the latest version to mitigate the risk of potential attacks. If immediate updating is not possible, validating and sanitizing input data can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json8-merge-patch →
FAQ
Prototype pollution is a vulnerability that allows attackers to modify the prototype of an object, leading to unexpected behavior and potential security issues.
The consequences of this vulnerability can vary depending on the attacker's intentions, but they may include remote code execution, data tampering, or denial of service attacks.
Yes, updating the json8-merge-patch package to version 1.0.3 or higher will fix this vulnerability.
While updating the package is the recommended solution, you can mitigate the risk by validating and sanitizing input data to prevent untrusted or user-controlled data from being used with the json8-merge-patch library.
You can find more information about this vulnerability in the CVE-2020-8268 advisory or by contacting the package maintainers.
