CVE-2026-48170

Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.1

Description scim-patch is subject to prototype pollution, a condition where an attacker can manipulate the prototype of base object classes. This occurs when the scimPatch() function processes a SCIM PATCH operation where the value object contains keys such as proto .someProp. This allows an attacker to set properties process-wide on Object.prototype, affecting every plain object within the Node process. This can lead to privilege escalation if authentication middleware checks boolean flags against plain objects, logic bypass, or Denial of Service (DoS). The issue is triggered when the assign() function walks a key path without filtering dangerous keys.

Recommendations Update scim-patch to version 0.9.1. As a temporary workaround, call Object.freeze(Object.prototype), Object.freeze(Array.prototype), and Object.freeze(Function.prototype) at process startup. Alternatively, use the Node --frozen-intrinsics flag to automatically freeze built-ins.