CVE-2026-48170 in scim-patch
Summary
by MITRE • 08/07/2026
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The scim-patch library vulnerability represents a critical prototype pollution flaw that affects versions prior to 091. This vulnerability stems from improper handling of SCIM patch operations where the value object contains keys following the pattern "_proto_.someProp". When such a malformed patch is processed, the library inadvertently modifies the global Object.prototype object, thereby affecting all plain objects within the Node.js process. The flaw operates at the core level of JavaScript's prototype chain mechanism, allowing attackers to inject malicious properties into the fundamental object structure that underpins all JavaScript applications running in the affected environment.
The technical execution of this vulnerability occurs during SCIM PATCH operations when attacker-controlled JSON data is processed through the scimPatch() function. This represents a classic prototype pollution attack vector where the attacker crafts a payload containing keys that traverse the prototype chain to reach Object.prototype. The impact extends beyond immediate application boundaries since any service utilizing this library and accepting external patch requests from identity providers becomes vulnerable. The vulnerability essentially allows an attacker to modify core JavaScript object properties that affect every subsequent object instantiation in the Node.js runtime, creating a persistent backdoor effect across the entire process.
The operational consequences of this vulnerability are severe and far-reaching within Node.js applications. Once exploited, attackers can manipulate fundamental object behaviors, potentially leading to arbitrary code execution, data corruption, or complete system compromise. The vulnerability is particularly dangerous because it requires no special privileges beyond access to a SCIM endpoint that accepts external patch operations from identity providers. This means any service implementing SCIM functionality with external identity provider integration becomes a potential target. The widespread adoption of Node.js in enterprise environments and the prevalence of SCIM implementations in identity management systems amplify the real-world impact of this vulnerability.
The remediation approach for this vulnerability involves upgrading to version 091 which contains the appropriate patch addressing the prototype pollution issue. Organizations can implement a temporary workaround by freezing Object.prototype and related prototypes at application startup using Object.freeze(Object.prototype) and similar calls for Array.prototype and Function.prototype. This defensive programming technique prevents malicious assignments to prototype objects from taking effect. Additionally, Node.js developers can utilize the --frozen-intrinsics flag which automatically applies this protection mechanism to built-in objects. The vulnerability aligns with CWE-471 and represents a specific instance of prototype pollution as categorized in the ATT&CK framework under initial access and privilege escalation techniques, emphasizing the need for input validation and prototype chain integrity checks in JavaScript applications.