kpdecker jsdiff vulnerabilities

Latest kpdecker jsdiff CVEs

Newest publication first

1. CVE-2026-24001 jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

   Published 2026-01-22

   Low·CVSS 2.7

   jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters \r, \u2028, or \u2029 can cause the parsePatch method to enter an infinite loop. It then...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.