CVE-2026-61834: scim-patch Library Path Traversal Flaw

CVE-2026-61834 Overview

CVE-2026-61834 is a prototype pollution vulnerability in scim-patch, a Node.js library for applying System for Cross-domain Identity Management (SCIM) patch operations. Versions prior to 0.9.2 expose the library to attacker-controlled SCIM PATCH paths that traverse inherited properties on JavaScript objects. The navigate() function reads inherited properties, and assign() performs prototype-chain membership checks when resolving path segments. An attacker can supply a path segment referencing an inherited property such as toString to reach shared built-in function objects and assign attacker-controlled properties on them. The result is process-global mutation that affects any application code reading inherited-method properties. The issue is tracked as [CWE-915] and fixed in version 0.9.2.

Critical Impact
Authenticated attackers submitting crafted SCIM PATCH requests can pollute shared built-in prototypes across the Node.js process, altering application logic that depends on inherited-method properties.

Affected Products

scim-patch versions prior to 0.9.2
Node.js applications that expose SCIM PATCH endpoints backed by scim-patch
Identity provisioning services integrating the vulnerable library

Discovery Timeline

2026-09-23 - CVE-2026-61834 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61834

Vulnerability Analysis

The flaw resides in how scim-patch resolves dotted SCIM PATCH paths against JavaScript objects. Two internal helpers, navigate() and assign(), treat inherited members as legitimate path targets. When a SCIM PATCH request contains a path or nested value key beginning with an inherited property name such as toString, constructor, or hasOwnProperty, the resolver walks into the shared built-in function object rather than the intended attribute. Once traversal reaches that shared object, subsequent assignment operations write attacker-controlled keys onto it. Because JavaScript built-in prototypes and functions are process-global, the mutation persists across requests and tenants within the same Node.js process. Application code that later reads inherited-method properties can observe attacker-controlled values, causing behavior deviations, feature-flag bypasses, or logic corruption.

Root Cause

The root cause is missing own-property validation during path resolution. The pre-patch code executed schema[subPath] || (schema[subPath] = {}), which follows the prototype chain when reading. Any inherited value satisfies the truthy check and is returned as the traversal target. Combined with attacker-controlled path segments, this violates the containment expected of a per-object attribute mutation and enables prototype pollution.

Attack Vector

Exploitation requires network access to a SCIM endpoint and low privileges sufficient to submit PATCH operations. No user interaction is required. The attacker crafts a SCIM PATCH payload where the path value, or a dotted key inside value, begins with an inherited property name. The pollution takes effect immediately and impacts subsequent request handling within the same process.

typescript

            });
        } else {
            schemas = schemas.flatMap((schema)=>{
-                if (!schema[subPath] && options.isRemoveOp)
+                // Only treat own properties as existing. Following inherited keys (e.g. toString)
+                // would resolve to shared built-ins and allow prototype pollution
+                // (GHSA-2mhw-wcx5-v3xj). For own keys we keep the original "||" semantics so a
+                // falsy intermediate (e.g. a null attribute) is still replaced with a container.
+                const existing = (schema != null && Object.prototype.hasOwnProperty.call(schema, subPath))
+                    ? schema[subPath]
+                    : undefined;
+                if (!existing && options.isRemoveOp)
                    throw new InvalidRemoveOpPath();

-                return schema[subPath] || (schema[subPath] = {});
+                return existing || (schema[subPath] = {});
            });
        }
    }

Source: GitHub Commit c86474f

Detection Methods for CVE-2026-61834

Indicators of Compromise

SCIM PATCH request bodies containing path values or nested keys that reference inherited members such as toString, constructor, hasOwnProperty, or __proto__.
Node.js process anomalies where built-in method behavior returns unexpected attacker-controlled values across requests.
Application error logs referencing InvalidRemoveOpPath or type errors in scim-patch traversal after pollution.

Detection Strategies

Inspect HTTP request logs for SCIM PATCH operations whose path field begins with a reserved JavaScript prototype attribute name.
Instrument application code to log or reject SCIM operations targeting non-schema attribute names.
Perform software composition analysis to identify deployments running scim-patch versions earlier than 0.9.2.

Monitoring Recommendations

Enable structured logging on SCIM endpoints and forward the events into a centralized analytics pipeline for correlation.
Alert on repeated PATCH attempts referencing prototype-related keys from a single principal or source IP.
Track dependency inventories and generate alerts when vulnerable scim-patch releases are reintroduced.

How to Mitigate CVE-2026-61834

Immediate Actions Required

Upgrade scim-patch to version 0.9.2 or later in every service that processes SCIM PATCH operations.
Audit SCIM ingress paths and revoke credentials that show anomalous PATCH activity referencing prototype keys.
Restart affected Node.js processes after remediation to clear any polluted prototypes retained in memory.

Patch Information

The maintainers released the fix in GitHub Release v0.9.2 via GitHub Pull Request #1127. The corrective change is documented in GitHub Commit c86474f and detailed in GitHub Security Advisory GHSA-2mhw-wcx5-v3xj. The patch replaces truthy inheritance checks with Object.prototype.hasOwnProperty.call() to ensure only own properties are treated as existing.

Workarounds

Validate incoming SCIM PATCH path and value keys against an allowlist derived from the declared SCIM schema attributes.
Reject requests containing path segments matching JavaScript built-in property names such as __proto__, constructor, prototype, or toString.
Freeze critical prototypes at application startup using Object.freeze(Object.prototype) where compatible with the runtime.

bash

# Upgrade to the patched release
npm install scim-patch@0.9.2

# Verify installed version
npm ls scim-patch