CVE-2026-77360mediumCWE-113

CVE-2026-77360: falha de média gravidade em middleapi orpc

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Publicada em

Seguir esta CVE+ Monitorar orpc+ Monitorar @orpc/server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
middleapi · orpc
CVEs relacionadas — middleapi orpc

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 1.1%CVE-2026-33331HIGHoRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifyEPSS 0.3%CVE-2026-103918MEDIUM@orpc/zod: Prototype injection in smart coercionEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%