THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-48170 (CRITICAL 9.1) — `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affectin

[NVD] CVE-2026-48170 (CRITICAL 9.1) — `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"proto.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affectin

lownvdPublished 2026-08-07

CVE-2026-48170 CVSS: 9.1 CRITICAL Published: 2026-08-07T22:16:59.170

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any serv

Indicators of compromise

CVE-2026-48170cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48170