CVE-2026-61834
Received Received - Intake

Prototype Pollution in scim-patch Library

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-61834
EUVD
EUVD-2026-85327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thomaspoignant scim-patch to 0.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Prototype Pollution issue in the scim-patch library affecting versions before 0.9.2. It occurs when the navigate() and assign() functions process attacker-controlled SCIM PATCH paths. These functions traverse inherited properties like toString, allowing mutation of shared built-in function objects. This leads to process-global changes that may impact application logic relying on inherited method properties.

Detection Guidance

To detect this vulnerability, check if your system uses scim-patch library versions prior to 0.9.2. Run: npm list scim-patch or npm audit. If vulnerable, update to version 0.9.2 or later.

Impact Analysis

An attacker could exploit this to modify global objects like Object.prototype, potentially altering application behavior. This might cause unexpected logic errors, data corruption, or security bypasses in applications using the vulnerable library. The impact is process-wide and could affect any code reading inherited properties.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling attackers to manipulate application logic through prototype pollution. If exploited, it may lead to unauthorized data access, modification, or processing, which violates GDPR's data integrity and confidentiality requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update the scim-patch library to version 0.9.2 or later. If updating is not possible, implement own-property checks like Object.hasOwn(obj, key) in patch path resolution and maintain denylists for dangerous keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart