The scim-patch library versions before 0.9.1 are vulnerable to prototype pollution via specially crafted SCIM PATCH operations. When an attacker-controlled JSON object contains keys such as "__proto__.someProp", the library sets properties on Object.prototype process-wide, affecting all plain objects in the Node.js runtime. This can lead to elevated impact including integrity and availability issues. The vulnerability is patched in version 0.9.1. A known workaround is to call Object.freeze on Object.prototype, Array.prototype, and Function.prototype at process startup, or to use Node.js's --frozen-intrinsics flag which freezes built-in prototypes automatically.

Successful exploitation allows an attacker to modify the global Object prototype in the Node.js process, impacting all plain objects. This can lead to integrity violations by altering application logic or data structures and can also affect availability. The CVSS score is 9.1 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on integrity and low impact on availability.

Upgrade scim-patch to version 0.9.1 or later, which contains an official patch for this vulnerability. As a workaround, freeze Object.prototype, Array.prototype, and Function.prototype at process startup using Object.freeze() to prevent prototype pollution. Alternatively, use the Node.js --frozen-intrinsics flag to automatically freeze built-in prototypes. Patch status is not explicitly stated beyond the availability of version 0.9.1 as a fix; check the vendor advisory for the latest remediation guidance.