Skip to main content

Node.js CVE-2026-28794

CRITICAL
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-03-06 security-advisories@github.com GHSA-m272-9rp6-32mc
Authentication Bypass RCE Denial Of Service Deserialization Node.js Orpc
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
PoC Detected
Mar 10, 2026 - 19:48 vuln.today
Public exploit code
Patch released
Mar 10, 2026 - 19:48 nvd
Patch available
CVE Published
Mar 06, 2026 - 05:16 nvd
CRITICAL 9.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 32 npm packages depend on @orpc/client (21 direct, 11 indirect)

Ecosystem-wide dependent count for version 1.13.6.

DescriptionNVD

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.

AnalysisAI

Prototype pollution in oRPC before 1.13.6. PoC and patch available.

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify all systems and dependencies using @orpc/client versions prior to 1.13.6 and isolate affected applications from production if not yet patched. Within 7 days: Apply vendor patch to version 1.13.6 or later across all affected systems and validate through testing. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-28794 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy