Thomaspoignant - Scim-patch - CRITICAL - CVE-2026-48170. The scim-patch library, prior to version 0.9.1, is vulnerable to prototype pollution through inadequate handling of SCIM PATCH operations. Specifically, if an attacker manages to submit a `value` object that contains a key formatted as `'__proto__.someProp'`, it will set `Object.prototype.someProp` within the Node.js process. This alteration impacts all plain objects, creating a security risk for any services utilizing `scimPatch()` and accepting PATCH requests from untrusted sources. Fortunately, version 0.9.1 rectifies this issue. As an immediate workaround, developers can invoke `Object.freeze(Object.prototype)`, along with similar calls for `Array.prototype` and `Function.prototype` at the startup of their processes, which effectively neutralizes this class of vulnerabilities.