Orpc
Monthly
Prototype pollution in oRPC before 1.13.6. PoC and patch available.
Prototype injection in oRPC's @orpc/zod smart-coercion plugin (versions prior to 1.14.10) allows a remote, unauthenticated client that can reach any procedure accepting object or record input to supply a crafted __proto__ key, causing attacker-controlled inherited properties to surface in subsequent application lookups, or to trigger an unhandled TypeError when keys such as constructor or toString are treated as inherited Zod schemas before validation. The impact is bounded: only the attacker's own crafted request object is affected - the global Object.prototype, other requests, other users, and persistent process state are untouched - which keeps this a moderate-severity information-disclosure and integrity issue (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) rather than a cross-tenant compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix is a public upstream change shipped in oRPC 1.14.10.
Prototype-chain manipulation in the oRPC @orpc/json-schema SmartCoercionPlugin (versions prior to 1.14.9) lets a remote, unauthenticated client inject `__proto__` or Object.prototype member names such as `constructor` and `toString` into a request body handled by any procedure that declares an object input schema. Abused successfully, this can steer the single coerced request object so attacker-controlled inherited values are treated as sub-schemas and satisfy the coercer's check, potentially influencing handler logic, Object.assign calls, or configuration lookups, with a secondary information-disclosure angle noted in vendor metadata. Impact is strictly bounded - the global Object.prototype, concurrent requests, other users, and unrelated objects are not modified, legitimate own-property `__proto__` fields are dropped, and downstream schema validation still runs - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Cache-key pollution in the @orpc/server CORS plugin (oRPC versions prior to 1.14.8) allows remote, unauthenticated clients to inject arbitrary Vary header values that are copied verbatim into HTTP responses, poisoning the cache keys used by shared caches, CDNs, or reverse proxies and producing inconsistent CORS enforcement for other clients. No authentication or user interaction is required (CVSS 4.0 vector shows PR:N/UI:N), but the impact is gated by deployment topology: per the vendor and independent assessment, default non-cached configurations have no established confidentiality, integrity, or availability impact, so single-instance or non-CDN deployments are effectively unaffected. The realistic exposure is a low-to-moderate integrity issue - scoped to the vulnerable component (S:C with I:L) - rather than the code-execution problem the misleading 'Code Injection' tag implies, and no public exploit code or CISA KEV entry was identified at time of analysis.
Prototype pollution in oRPC before 1.13.6. PoC and patch available.
Prototype injection in oRPC's @orpc/zod smart-coercion plugin (versions prior to 1.14.10) allows a remote, unauthenticated client that can reach any procedure accepting object or record input to supply a crafted __proto__ key, causing attacker-controlled inherited properties to surface in subsequent application lookups, or to trigger an unhandled TypeError when keys such as constructor or toString are treated as inherited Zod schemas before validation. The impact is bounded: only the attacker's own crafted request object is affected - the global Object.prototype, other requests, other users, and persistent process state are untouched - which keeps this a moderate-severity information-disclosure and integrity issue (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) rather than a cross-tenant compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix is a public upstream change shipped in oRPC 1.14.10.
Prototype-chain manipulation in the oRPC @orpc/json-schema SmartCoercionPlugin (versions prior to 1.14.9) lets a remote, unauthenticated client inject `__proto__` or Object.prototype member names such as `constructor` and `toString` into a request body handled by any procedure that declares an object input schema. Abused successfully, this can steer the single coerced request object so attacker-controlled inherited values are treated as sub-schemas and satisfy the coercer's check, potentially influencing handler logic, Object.assign calls, or configuration lookups, with a secondary information-disclosure angle noted in vendor metadata. Impact is strictly bounded - the global Object.prototype, concurrent requests, other users, and unrelated objects are not modified, legitimate own-property `__proto__` fields are dropped, and downstream schema validation still runs - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Cache-key pollution in the @orpc/server CORS plugin (oRPC versions prior to 1.14.8) allows remote, unauthenticated clients to inject arbitrary Vary header values that are copied verbatim into HTTP responses, poisoning the cache keys used by shared caches, CDNs, or reverse proxies and producing inconsistent CORS enforcement for other clients. No authentication or user interaction is required (CVSS 4.0 vector shows PR:N/UI:N), but the impact is gated by deployment topology: per the vendor and independent assessment, default non-cached configurations have no established confidentiality, integrity, or availability impact, so single-instance or non-CDN deployments are effectively unaffected. The realistic exposure is a low-to-moderate integrity issue - scoped to the vulnerable component (S:C with I:L) - rather than the code-execution problem the misleading 'Code Injection' tag implies, and no public exploit code or CISA KEV entry was identified at time of analysis.