The scim-patch library versions before 0.9.1 are vulnerable to prototype pollution via SCIM PATCH operations that include keys targeting the __proto__ property. This causes Object.prototype to be modified globally within the Node.js process, impacting all plain objects. Such pollution can lead to elevated privileges or arbitrary code execution depending on the application context. The vulnerability is patched in version 0.9.1. A known workaround is to call Object.freeze on Object.prototype, Array.prototype, and Function.prototype at process startup, or to use Node.js's --frozen-intrinsics flag which freezes built-in prototypes automatically.

Successful exploitation allows an attacker to modify the global Object prototype in a Node.js process, potentially leading to privilege escalation, arbitrary code execution, or other integrity and availability impacts. The CVSS score of 9.1 reflects critical severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability.

Upgrade to scim-patch version 0.9.1 or later where the vulnerability is patched. If upgrading is not immediately possible, apply the workaround by freezing Object.prototype, Array.prototype, and Function.prototype at process startup using Object.freeze(), or run Node.js with the --frozen-intrinsics flag to prevent prototype pollution. These mitigations neutralize the vulnerability by making prototype assignments no-ops or causing errors.