CVE-2026-77360mediumCWE-113

CVE-2026-77360: medium-severity vulnerability in middleapi orpc

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Published

Follow this CVE+ Monitor orpc+ Monitor @orpc/server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.5%
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
middleapi · orpc
Related CVEs — middleapi orpc

In the same product, most dangerous first.

CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 1.1%CVE-2026-33331HIGHoRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifyEPSS 0.3%CVE-2026-103918MEDIUM@orpc/zod: Prototype injection in smart coercionEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%