js · scim-patchCritical
scim-patch vulnerable to prototype pollution via SCIM PATCH operations
scim-patch <=0.9.0 is vulnerable to prototype pollution via SCIM PATCH operations where the value object contains keys like '__proto__.someProp', allowing attac
What changed
scim-patch <=0.9.0 is vulnerable to prototype pollution via SCIM PATCH operations where the value object contains keys like '__proto__.someProp', allowing attackers to set properties on Object.prototype process-wide.
Who it affects
Any service using scim-patch that accepts SCIM PATCH requests from external IdPs on Node.js.
What to do today
Upgrade scim-patch to a patched version once available, or apply the suggested fix by rejecting dangerous keys in assign(). As a temporary mitigation, call Object.freeze(Object.prototype) at process startup or use Node's --frozen-intrinsics flag.
The trail
Collected→
Audited→
Written→
Published