CVE-2026-48170

Received Received - Intake

Prototype Pollution in scim-patch Library

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48170

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability affects the scim-patch library before version 0.9.1. It allows prototype pollution when processing a SCIM PATCH operation with a value object containing a key like __proto__.someProp. This sets Object.prototype.someProp globally, impacting all plain objects in the Node process. Any service using scimPatch() on untrusted JSON is vulnerable.

Detection Guidance

Check if your system uses scim-patch library versions prior to 0.9.1. Inspect Node.js applications handling SCIM PATCH operations for prototype pollution risks. Use Node.js with --frozen-intrinsics flag to mitigate. No direct detection commands are provided in the context.

Impact Analysis

An attacker could manipulate Object.prototype properties, leading to unexpected behavior or security bypasses in applications using the vulnerable library. This could allow unauthorized data access, privilege escalation, or denial of service in services processing SCIM PATCH requests.

Compliance Impact

This vulnerability could lead to unauthorized modification of application behavior or data integrity issues by polluting the Object prototype. For GDPR, this may impact data integrity and security measures required under Articles 5 and 32. For HIPAA, it could affect the integrity and security of protected health information as defined in the Security Rule.

Mitigation Strategies

Upgrade scim-patch to version 0.9.1 or later. Apply Object.freeze(Object.prototype) and Object.freeze(Array.prototype) at process startup. Use Node.js --frozen-intrinsics flag to automatically freeze built-in prototypes.

Hi! I’m here to help you understand CVE-2026-48170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70