Threats tagged 'ghsa-gcgf-fh7c-8gf2'

CVE-2026-103918 is a medium severity vulnerability in the middleapi orpc package affecting the ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin. These plugins improperly handle object keys that match Object.prototype members, allowing an attacker to replace the prototype of a coerced input object or cause unhandled TypeErrors by sending keys like 'constructor'. The issue is limited to the request payload and does not affect global state or other requests. It is fixed in version 1.14.10.