CVE-2026-103918
MediumCVSS 6.5Summary
oRPC is a tool that helps build APIs that are end-to-end type-safe. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object properties in plain objects and resolve shape keys through the prototype chain. A remote client can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups.
Risk Assessment
An attacker can influence application logic through prototype manipulation, potentially leading to unexpected behavior or data exposure.
Recommendation
Update oRPC to version 1.14.10 or later, which fixes this vulnerability.
Other vulnerabilities in oRPC
See all- CVE-2026-103036Medium
oRPC is a tool that helps build APIs that are end-to-end type-safe. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas.
- CVE-2026-77360Medium
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients.
Original NVD description (English source)
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS