The vulnerability arises from improper handling of the Vary HTTP header in the orpc @orpc/server CORS plugin before version 1.14.8. Instead of controlling Vary as a response-only header and using Origin for request-origin variation, the plugin copies the client's incoming Vary request header into the response. In deployments behind shared caches, CDNs, or reverse proxies that use Vary to key responses, this allows a client to inject arbitrary variation values, causing cache key pollution and inconsistent CORS enforcement for other clients. The issue is addressed by correcting header handling in version 1.14.8.

In environments using shared caches, CDNs, or reverse proxies that key responses based on the Vary header, an attacker can manipulate cache keys by injecting arbitrary variation values. This can lead to inconsistent CORS enforcement affecting other clients. However, in default non-cached configurations, there is no direct impact on confidentiality, integrity, or availability.

Upgrade to orpc version 1.14.8 or later, where the issue is fixed by proper handling of the Vary header. No additional mitigation is required if upgrading is not immediately possible, but be aware of the risk in shared caching environments.