CVE-2026-48170

"scim-patch", a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose "value" object contains a key like ""proto.someProp"". After one such patch, "Object.prototype.someProp" is set process-wide, affecting every plain object ...