Executive brief
The scim-patch library, used for managing user identity data in Node.js applications, is vulnerable to a flaw that allows an attacker to modify the behavior of the entire application. By sending a specially crafted update request, an attacker can inject malicious properties into the application's core memory. This can lead to unauthorized access, privilege escalation, or service disruptions that persist until the application is restarted.
Technical details
A prototype pollution vulnerability exists in scim-patch versions up to 0.9.0. The root cause is in the `addOrReplaceObjectAttribute` and `assign` functions within `src/scimPatch.ts`, which fail to filter dangerous keys such as `__proto__`, `constructor`, or `prototype` when resolving paths from user-supplied JSON. An attacker with the ability to send a SCIM PATCH request can inject properties into `Object.prototype`, affecting all plain objects within the Node.js process. This can be leveraged for privilege escalation or denial of service. The issue is fixed in version 0.9.1.
Affected products
- thomaspoignant scim-patch <= 0.9.0
Timeline
- 2026-05-21: disclosed
- 2026-06-22: advisory: GitHub Advisory published
- 2026-06-22: patched