scimPatch vulnerable to prototype pollution via unfiltered keys in patch
Date: 2026-06
Affected: npm/scim-patch
Attack vector: dos
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-48170
CWE: CWE-1321
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L)

## Summary `scim-patch` performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. ## Impact - **Class:** Prototype pollution ([CWE-1321](https://cwe.mitre.org/data/definitions/1321.html)) - **Affected versions:** `<= 0.9.0` (current HEAD `871b1e2`) - **Attack vector:** Network — sent as part of a normal SCIM `PATCH /Users/:id` request body. - **Privileges required:** Whatever the SCIM endpoint requires. For most integrations that's a provisioned IdP, which is "low" in CVSS terms (any authenticated provisioning client). - **Scope:** Changed — the bug is in a SCIM library but the side effect (`Object.prototype` mutation) leaks into the entire Node process. Downstream consequences depend on what other code reads from plain objects. Realistic outcomes observed in similar bugs: - **Privilege escalation** if any auth/middleware code checks `actor.isAdmin` / `req.user.admin` / similar boolean flags against a plain object that *expects* the key to be absent. - **Logic bypass / DoS** if any code branches on `obj.name`, `obj.type`, `obj.id` etc. against plain objects (e.g. `pg`'s prepared-statement naming check — a real inci


Mitigations:

Architectural layers (MAESTRO):