Skip to content
OpenAdvisories

Vendor

middleapi

5 known vulnerabilities.

Products

orpc 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-103918

    @orpc/zod: Prototype injection in smart coercion

    oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolv…

    middleapi orpc @orpc/zod npm
  • Medium 6.5
    CVE-2026-103036

    @orpc/json-schema: Prototype injection in smart coercion

    oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properti…

    middleapi orpc
  • Medium 6.3
    CVE-2026-77360

    oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

    oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead …

    middleapi orpc @orpc/server npm