What is the CVSS score of CVE-2026-28794?

CVE-2026-28794 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Node.js are affected by CVE-2026-28794?

A critical vulnerability in the oRPC @orpc/client package (CVE-2026-28794) allows remote attackers to inject malicious code into application memory without authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28794?

Yes, a public proof-of-concept exploit is available for CVE-2026-28794. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-28794?

Within 24 hours: Identify all systems and dependencies using @orpc/client versions prior to 1.13.6 and isolate affected applications from production if not yet patched. Within 7 days: Apply vendor patch to version 1.13.6 or later across all affected systems and validate through testing. Within 30 days: Conduct security audit of systems that were running vulnerable versions to detect any unauthorized access or object pollution artifacts.

Node.js CVE-2026-28794

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-06 security-advisories@github.com

GHSA-m272-9rp6-32mc

Node.js RCE Denial Of Service Authentication Bypass Deserialization Orpc

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 19:48 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 19:48 nvd

Patch available

CVE Published

Mar 06, 2026 - 05:16 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

32 npm packages depend on @orpc/client (21 direct, 11 indirect)

Ecosystem-wide dependent count for version 1.13.6.

DescriptionGitHub Advisory

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.