Skip to content
OpenAdvisories

Package · npm

@orpc/server

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-77360

    oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

    oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead …

    middleapi orpc @orpc/server npm