CVE-2026-16008: json-schema-library RCE Vulnerability

CVE-2026-16008 Overview

CVE-2026-16008 is a prototype pollution vulnerability in the sagold/json-schema-library npm package, affecting versions 11.5.0 and 11.5.1. The flaw resides in the parsePropertyDependencies function within src/keywords/propertyDependencies.ts. Attackers can manipulate object prototype attributes by supplying crafted JSON schema input, leading to improperly controlled modification of object prototype attributes [CWE-94]. The issue is exploitable remotely and requires low privileges. The maintainer released version 11.6.0 containing patch 432287ee6f68a02ce6f015354618486ec427a32d.

Critical Impact
Remote attackers with low privileges can pollute JavaScript object prototypes, potentially altering application logic or enabling downstream code injection in applications that consume validated schemas.

Affected Products

sagold json-schema-library version 11.5.0
sagold json-schema-library version 11.5.1
Node.js applications and libraries that depend on the affected versions for JSON schema validation

Discovery Timeline

2026-07-17 - CVE-2026-16008 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-16008

Vulnerability Analysis

The vulnerability affects json-schema-library, a TypeScript library for validating JSON schemas. In the parsePropertyDependencies function, the code retrieves a value from user-controlled input and uses it as a lookup key against the dependentProperties object without checking whether the key belongs to the object itself or its prototype chain. This allows an attacker to reference inherited properties such as __proto__, constructor, or prototype and inject values into Object.prototype.

Once prototype pollution occurs, every object in the Node.js process inherits the injected property. Downstream consumers may then observe unexpected values in property lookups, which can break authentication checks, alter access control decisions, or enable secondary injection paths [CWE-94].

Root Cause

The root cause is unsafe property access against an object that inherits from Object.prototype. The vulnerable code used bracket notation on the dependentProperties map without validating that the key was an own property. Additionally, mergeSchema2 created merge targets using object literal syntax ({}), which inherits from Object.prototype and permits pollution during recursive merges.

Attack Vector

An attacker supplies a JSON schema containing crafted dependentProperties entries whose keys or values reference prototype attributes. When the library parses this schema, the polluted properties propagate to Object.prototype and affect all subsequent object operations within the process.

typescript

// Patched code from src/keywords/propertyDependencies.ts
const matchingSchemata: { property: string; value: string; node: SchemaNode }[] = [];
for (const propertyName of dependentPropertyNames) {
    if (hasProperty(data, propertyName)) {
        const dependentValues = dependentProperties[propertyName];
        const value = `${data[propertyName]}`;
        if (hasProperty(dependentValues, value)) {
            matchingSchemata.push({
                property: propertyName,
                value,
                node: dependentValues[value]
            });
        }
    }
}
// Source: https://github.com/sagold/json-schema-library/commit/432287ee6f68a02ce6f015354618486ec427a32d

The fix in src/utils/mergeSchema.ts switches merge targets to prototype-less objects:

typescript

export function mergeSchema2(a: unknown, b: unknown, property?: string): unknown {
    if (isObject(a) && isObject(b)) {
        const newObject: Record<string, unknown> = Object.create(null);
        [...Object.keys(a), ...Object.keys(b)]
            .filter((item, index, array) => array.indexOf(item) === index)
            .forEach((key) => (newObject[key] = mergeSchema2(a[key], b[key], key)));
    }
}
// Source: https://github.com/sagold/json-schema-library/commit/432287ee6f68a02ce6f015354618486ec427a32d

Detection Methods for CVE-2026-16008

Indicators of Compromise

JSON schema inputs containing keys such as __proto__, constructor, or prototype inside dependentProperties blocks
Unexpected properties appearing on plain objects at runtime that were never explicitly assigned
Application errors or altered control flow immediately following schema validation calls

Detection Strategies

Perform software composition analysis (SCA) to identify Node.js projects that declare json-schema-library versions 11.5.0 or 11.5.1 in package.json or package-lock.json
Enable static analysis rules that flag bracket-notation property assignment on untrusted keys within TypeScript and JavaScript codebases
Review the EPSS score of 0.262% as low but track any change in exploitation likelihood on the VulDB CVE-2026-16008 entry

Monitoring Recommendations

Log and inspect JSON payloads submitted to schema validation endpoints for prototype-related keys
Instrument Node.js runtimes with hooks that detect writes to Object.prototype during request processing
Correlate schema validation errors with subsequent authorization or business-logic anomalies

How to Mitigate CVE-2026-16008

Immediate Actions Required

Upgrade json-schema-library to version 11.6.0 or later in all affected projects
Audit dependency trees using npm ls json-schema-library to locate transitive uses
Reject or sanitize incoming JSON schemas that contain __proto__, constructor, or prototype keys before validation

Patch Information

The maintainer released version 11.6.0 containing commit 432287ee6f68a02ce6f015354618486ec427a32d, which switches internal merge targets to Object.create(null) and uses hasProperty guards before dependent-value lookup. Details are available in the GitHub Commit, the GitHub Issue #111, and the v11.6.0 Release Notes.

Workarounds

Freeze Object.prototype early during application startup using Object.freeze(Object.prototype) to prevent runtime pollution
Wrap calls to parsePropertyDependencies with input validators that strip prototype-referencing keys
Isolate schema validation into a dedicated worker process so pollution cannot affect the primary application context

bash

# Upgrade the vulnerable dependency
npm install json-schema-library@11.6.0 --save

# Verify installed version across the dependency tree
npm ls json-schema-library

# Optional: audit for known advisories
npm audit --production