Threat database

CVE-2026-103918 is a medium severity vulnerability in the middleapi orpc package affecting the ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin. These plugins improperly handle object keys that match Object.prototype members, allowing an attacker to replace the prototype of a coerced input object or cause unhandled TypeErrors by sending keys like 'constructor'. The issue is limited to the request payload and does not affect global state or other requests. It is fixed in version 1.14.10.

CVE-2026-103036 is a medium severity vulnerability in the orpc component of middleapi prior to version 1.14.9. It involves improper control of dynamically-determined object attributes during JSON schema coercion, allowing a remote client to supply crafted __proto__ or Object.prototype properties that influence the behavior of the coerced request object. This can affect handler logic and configuration lookups without modifying global objects or other users' requests. The issue is fixed in version 1.14.9.

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

CVE-2026-33331 is a high-severity stored cross-site scripting (XSS) vulnerability affecting versions of the middleapi orpc tool prior to 1.13.9. The vulnerability arises from improper neutralization of input during the generation of OpenAPI documentation, allowing attackers who can control fields in the OpenAPI specification (e.g. , info.description) to inject malicious JavaScript. When a user views the generated API documentation, this script executes, potentially compromising confidentiality by stealing sensitive data. Exploitation requires no authentication but does require user interaction to view the malicious documentation. The vulnerability has been patched in version 1.

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.