Description
scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "__proto__.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process.
Any service that calls scimPatch() on attacker-controlled JSON (i.e.
Recommendation
Update the scim-patch package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.9.0
- Patched version(s): 0.9.1
References
Could your website be exposed too?
SmartScanner can check your website for scimPatch vulnerable to prototype pollution via unfiltered keys in patch and gives you actionable findings to investigate.
Start a free scanRelated Issues
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
- deepHas vulnerable to Prototype Pollution via constructor.prototype - CVE-2026-25047
- form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys - CVE-2026-46510
You might also like:
See something that needs correcting? Let us knowUpdated June 22, 2026