CVE-2026-61834: scim-patch Inherited Built-in Method Mutation Vulnerability
Summary
CVE-2026-61834: scim-patch: Mutation of Inherited Built-in Method Objects. Affects scim-patch versions < 0.9.2. Fixed in 0.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'scim-patch' package is a JavaScript library used for applying SCIM (System for Cross-domain Identity Management) patches to objects. It allows developers to modify user attributes in a structured way. However, it has a vulnerability that permits the mutation of inherited built-in method objects, which can lead to unintended consequences in application logic.
Vulnerability Detail
The vulnerability arises from an incomplete prototype pollution fix in the 'scim-patch' package. While it blocks direct access to dangerous path segments like 'proto', 'constructor', and 'prototype', it still allows traversal of inherited properties. An attacker can exploit this by manipulating SCIM PATCH operations to mutate shared built-in function objects, such as 'Object.prototype.toString'. This can lead to the addition of attacker-controlled properties to these objects, potentially affecting the entire application.
How To Fix
Minimum fixed version
0.9.2
This is the first release that contains the fix.
npm install scim-patch@0.9.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using SCIM PATCH operations that involve inherited properties. Instead, ensure that all patch paths are limited to own properties of the target object. Here is an example of how to safely apply a patch without traversing inherited properties:
const victim = {
schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
userName: "alice",
active: true,
emails: [{ value: "alice@example.com", primary: true }],
meta: { created: "x", lastModified: "x", resourceType: "User" }
};
// Safe patch operation
scimPatch(victim, [ { op: "add", path: "emails[0].value", value: "alice@newdomain.com" }
]);
Conclusion
The 'scim-patch' vulnerability (CVE-2026-61834) poses a risk by allowing the mutation of inherited built-in method objects. It is crucial for developers using this package to update to the patched version and implement best practices to avoid potential security issues.
See every vulnerability recorded for scim-patch →
FAQ
The vulnerability allows for the mutation of inherited built-in method objects, which can lead to unintended changes in application behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground.
The mutation is process-global and may affect application logic that relies on inherited methods, leading to unexpected behavior or security issues.
Yes, the vulnerability has been fixed in version 0.9.2 of the 'scim-patch' package. It is recommended to update to this version.
Update the 'scim-patch' package to version 0.9.2 or later and ensure that your code does not traverse inherited properties when applying patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for scim-patch.
