CVE-2026-48170

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.

• CWE-1321

• https://github.com/thomaspoignant/scim-patch/commit/260f9cd2ac5ceac3976978850bb47dcb391720f6
• https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c
• https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c

Published

Aug 7, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48165MariaDB server is a community developed fork of MySQL server…7.2
• CVE-2026-48166Filament is a collection of full-stack components for accele…5.3
• CVE-2026-48167Filament is a collection of full-stack components for accele…6.4
• CVE-2026-48168PraisonAI is a multi-agent teams system. In versions prior t…10
• CVE-2026-48169PraisonAI is a multi-agent teams system. Versions prior to 0…8.8
• CVE-2026-4817The MasterStudy LMS WordPress Plugin for Online Courses and …6.5
• CVE-2026-48172LiteSpeed User-End cPanel Plugin before 2.4.5 allows privile…9.8
• CVE-2026-48173In the NAS message handler, improper validation of the lengt…9.8
• CVE-2026-48174In the NR RRC component, improper handling of messages befor…9.8
• CVE-2026-48175Processing a malformed RRC message leads to an out-of-bounds…5.5
• CVE-2026-48176A memory corruption vulnerability caused by improper validat…7.5
• CVE-2026-48178Out of bound access in PPC due to race condition in global v…8.8