CVE-2026-61834: Prototype Pollution and Mutation of Inherited Built-in Method Objects in scim-patch

The vulnerability identified as CVE-2026-61834 is a medium-severity security flaw within the scim-patch library. This NPM package is designed to parse and apply SCIM patch operations according to RFC 7644 specifications. The library failed to restrict modification of inherited built-in methods during path-resolution and assignment routines.\n\nWhile standard prototype pollution vectors targeting explicit keywords like __proto__ or constructor were blocked by a denylist, the traversal logic remained vulnerable to inherited property lookups. An authenticated attacker can target inherited properties such as toString, valueOf, or hasOwnProperty. Because JavaScript resolves these properties through the prototype chain to global built-in functions, the library proceeds to mutate these shared function objects.\n\nThis behavior maps to CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The attack surface is exposed via standard SCIM API endpoints that process client-defined patch payloads. Successful exploitation permits process-global mutation of built-in method objects.

The root cause of this vulnerability lies in the reliance on unconstrained property lookups within the path navigation and value assignment implementations of scim-patch. Specifically, the library utilizes the standard bracket lookup operator (schema[subPath]) and the in operator (key in obj) to verify the existence of intermediate nodes during path resolution.\n\nIn JavaScript, both of these operations evaluate properties across the entire prototype chain of the object. When a SCIM patch path segment specifies a built-in method like toString, the expression schema['toString'] evaluates to the native Function.prototype.toString or Object.prototype.toString object. Since the expression returns a truthy value, the library incorrectly assumes that the path segment represents an already initialized local property.\n\nThe resolver then uses this resolved function object as the context for downstream property writes. When the final assignment takes place, the library appends arbitrary properties directly onto the shared native function object. This behavior compromises the integrity of the execution environment, polluting the global scope and modifying how the application processes object evaluations.

The vulnerable version of the library utilizes unsafe lookup patterns in two critical areas: navigate() and assign(). In the navigate() function, the resolution loop does not check whether a property belongs to the target object itself or if it is inherited from the prototype chain.\n\ntypescript\n// Vulnerable path resolution pattern\nschemas = schemas.flatMap((schema)=>{\n if (!schema[subPath] && options.isRemoveOp)\n throw new InvalidRemoveOpPath();\n\n return schema[subPath] || (schema[subPath] = {});\n});\n\n\nSimilarly, in the assign() function, the existence of intermediate path keys is checked using the in operator. Because in returns true for inherited keys, the check fails to catch native functions like toString, allowing the assignment function to descend into the global function prototype and write the target property onto it.\n\ntypescript\n// Vulnerable assignment pattern\nfor (let i = 0; i < lastKeyIndex; ++ i) {\n const key = keyPath[i];\n if (!(key in obj)){\n obj[key] = {};\n }\n obj = obj[key];\n}\n\n\nThe fix introduced in version 0.9.2 replaces these operations with explicit Object.prototype.hasOwnProperty.call() checks. This modification ensures that any inherited property that does not explicitly exist as an 'own' property of the target object is treated as missing. The library subsequently creates a fresh local object to shadow the inherited name rather than modifying the global built-in.\n\nmermaid\ngraph LR\n subgraph Vulnerable Flow\n A["Path Segment 'toString'"] --> B{"schema['toString'] Check"}\n B -->|Resolves to Function.prototype| C["Descend into Global built-in"]\n C --> D["Pollute Global toString Object"]\n end\n subgraph Patched Flow\n E["Path Segment 'toString'"] --> F{"hasOwnProperty('toString') Check"}\n F -->|False| G["Create Local Object {}"]\n G --> H["Shadow inherited property safely"]\n end\n

Exploitation of CVE-2026-61834 requires the ability to send authenticated SCIM PATCH requests to an application that processes user or group attributes using the scim-patch package. The attack can be initiated through two distinct payload structures: dotted path notation and implicit path resolution via the value payload.\n\nIn the dotted path vector, an attacker includes a target path that references a built-in method followed by a custom attribute name, such as toString.polluted. The parsing engine processes the first segment (toString), resolves it to the global prototype, and appends the second segment (polluted) with the provided value directly onto the native function.\n\njson\n[\n {\n "op": "add",\n "path": "toString.pollutedAttribute",\n "value": "polluted"\n }\n]\n\n\nIn the alternative vector, where no path is explicitly defined, the attacker can leverage the keys of the value object. The assignment engine processes each key, performing the same unsafe in check on keys such as toString.nestedValue. This achieves an identical result, polluting the runtime environment.\n\njson\n[\n {\n "op": "add",\n "value": {\n "toString.implicitPolluted": "polluted"\n }\n }\n]\n

The impact of this vulnerability is characterized by a process-global integrity compromise. Although mutating built-in methods does not immediately expose sensitive data, it destabilizes the JavaScript execution environment. This can cause downstream application libraries or frameworks to crash, leading to a Denial of Service.\n\nFurthermore, prototype pollution of this nature can lead to secondary vulnerabilities. If downstream application logic evaluates properties on native objects without performing safety checks, an attacker may exploit this behavior to execute arbitrary code or bypass security controls. This is particularly critical in authentication modules, authorization checks, and logging utilities that invoke native methods such as toString() during processing.\n\nThe CVSS 3.1 score is calculated as 4.3 (Medium), reflecting a network-based attack vector with low complexity and low integrity impact, but requiring low-privileged user authentication. The impact on confidentiality and availability is rated as none under the base vector, although secondary exploitation could elevate these impacts depending on application context.

The primary remediation strategy is upgrading the scim-patch library to version 0.9.2 or higher. The patch incorporates explicit own-property checks, preventing the traversal engine from resolving inherited built-in methods as valid path structures.\n\nFor environments where immediate patching is not feasible, several defensive-in-depth measures can be deployed to reduce exposure. Network-level mitigations include configuring Web Application Firewalls (WAFs) to inspect incoming SCIM PATCH payloads and reject requests containing path segments matching known built-in method names.\n\nAdditionally, developers can freeze native prototype objects at application startup to prevent any modifications from taking place:\n\njavascript\n// Freeze built-in prototypes to block pollution\nObject.freeze(Object.prototype);\nObject.freeze(Function.prototype);\n