CVE-2026-48170: scim-patch Prototype Pollution Vulnerability

CVE-2026-48170 Overview

The scim-patch Node.js library contains a prototype pollution vulnerability [CWE-1321] in versions prior to 0.9.1. The flaw occurs when the library applies a System for Cross-domain Identity Management (SCIM) PATCH operation containing a value object with a key such as "__proto__.someProp". A single such patch sets Object.prototype.someProp process-wide, affecting every plain object in the Node.js runtime. Any service invoking scimPatch() on attacker-controlled JSON is exploitable, which includes SCIM endpoints accepting PATCH requests from external Identity Providers (IdPs).

Critical Impact

Attackers with low-privilege access to a SCIM PATCH endpoint can poison Object.prototype across the entire Node process, enabling downstream integrity compromise and denial of service.

Affected Products

• scim-patch npm library versions prior to 0.9.1
• Node.js services exposing SCIM PATCH endpoints that consume external IdP input
• Identity provisioning integrations built on scim-patch

Discovery Timeline

• 2026-08-07 - CVE-2026-48170 published to the National Vulnerability Database (NVD)
• 2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-48170

Vulnerability Analysis

The vulnerability stems from unsafe recursive assignment when scim-patch walks the dotted path expressed in a PATCH operation's value keys. The library treats each dotted segment as a property to descend into or create on the target object. When an attacker supplies a key like "__proto__.someProp", the library resolves __proto__ to the shared prototype and writes someProp onto Object.prototype.

After one such request, every plain object in the Node.js process inherits the attacker-controlled property. This can subvert authorization checks that rely on if (obj.isAdmin) style tests, corrupt configuration state, and trigger crashes in code paths that iterate object keys.

Root Cause

The library did not filter dangerous property names before writing to the target object. The upstream fix introduces an explicit deny list of keys that could reach Object.prototype, specifically __proto__, constructor, and prototype.

Attack Vector

Exploitation requires network access to a SCIM PATCH endpoint and low-privileged credentials, typically those held by a federated IdP. No user interaction is required. The scope is changed because pollution of Object.prototype affects components beyond the vulnerable module.

// Patch from src/scimPatch.ts (GHSA-9m6g-wc8r-q59c)
 const CORE_SCHEMA_USER = 'urn:ietf:params:scim:schemas:core:2.0:User';
 const CORE_SCHEMA_GROUP = 'urn:ietf:params:scim:schemas:core:2.0:Group';
+// Keys that would let a patch reach Object.prototype (prototype pollution, GHSA-9m6g-wc8r-q59c).
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

 export const PATCH_OPERATION_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:PatchOp';

Source: GitHub Commit 260f9cd. The patch introduces a DANGEROUS_KEYS set used to reject any path segment that would resolve to a prototype-reaching property.

Detection Methods for CVE-2026-48170

Indicators of Compromise

• SCIM PATCH request bodies whose JSON value objects contain keys matching __proto__, constructor, or prototype
• Unexpected properties appearing on plain objects across unrelated code paths inside the Node.js process
• Application logs showing authorization decisions flipping without a corresponding user or role change

Detection Strategies

• Inspect HTTP request bodies to /scim/v2/Users and /scim/v2/Groups PATCH endpoints for the strings __proto__, constructor.prototype, or prototype. inside value fields
• Add runtime guards that assert Object.prototype has no unexpected enumerable keys during health checks
• Correlate SCIM PATCH traffic from IdP source IPs with process crashes or authorization anomalies in the same time window

Monitoring Recommendations

• Log full SCIM PATCH payloads at the API gateway or reverse proxy for retrospective analysis
• Alert on any package.json deployment where scim-patch resolves to a version below 0.9.1
• Track process restarts and unhandled TypeError exceptions in services that consume SCIM input

How to Mitigate CVE-2026-48170

Immediate Actions Required

• Upgrade scim-patch to version 0.9.1 or later in all Node.js services exposing SCIM PATCH endpoints
• Audit dependency trees with npm ls scim-patch to identify transitive uses of the vulnerable library
• Restrict SCIM PATCH endpoint access to authenticated IdP source IPs where feasible

Patch Information

Version 0.9.1 contains the fix committed in GitHub Commit 260f9cd. Additional details are published in the GitHub Security Advisory GHSA-9m6g-wc8r-q59c.

Workarounds

• Freeze built-in prototypes at process startup by calling Object.freeze(Object.prototype), Object.freeze(Array.prototype), and Object.freeze(Function.prototype)
• Launch Node.js with the --frozen-intrinsics flag to freeze all built-in prototypes automatically
• Add an input filter in front of scimPatch() that rejects payloads containing __proto__, constructor, or prototype in any key

# Launch Node.js with frozen intrinsics as an interim mitigation
node --frozen-intrinsics server.js

# Or freeze prototypes explicitly at startup
node -e "Object.freeze(Object.prototype); Object.freeze(Array.prototype); Object.freeze(Function.prototype); require('./server');"