Prototype Pollution Vulnerability in scim-patch Library by Thomas Poignant

CVE-2026-48170

What is CVE-2026-48170?

The scim-patch library, prior to version 0.9.1, is vulnerable to prototype pollution through inadequate handling of SCIM PATCH operations. Specifically, if an attacker manages to submit a value object that contains a key formatted as '__proto__.someProp', it will set Object.prototype.someProp within the Node.js process. This alteration impacts all plain objects, creating a security risk for any services utilizing scimPatch() and accepting PATCH requests from untrusted sources. Fortunately, version 0.9.1 rectifies this issue. As an immediate workaround, developers can invoke Object.freeze(Object.prototype), along with similar calls for Array.prototype and Function.prototype at the startup of their processes, which effectively neutralizes this class of vulnerabilities.

References