CVE-2026-77360 Details
Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
A vulnerability exists in the oRPC CORS plugin for the @orpc/server package, affecting versions prior to 1.14.8. The issue arises because the plugin improperly copies the client's Vary request header into the response. This mismanagement allows clients to inject arbitrary variation values, potentially polluting cache keys and causing inconsistent CORS enforcement for other clients. The vulnerability is particularly concerning in environments with shared caches, CDNs, or reverse proxies that key responses based on the Vary header.
Users should update the @orpc/server package to version 1.14.8 or later. This update ensures that the CORS plugin manages the Vary header correctly, deriving it solely from the response and appending the Origin header as needed, without duplicating existing values.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/middleapi/orpc/issues/1661 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f | [email protected] | Source CodeVendor |
| https://github.com/middleapi/orpc/issues/1661 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/middleapi/orpc/pull/1662 | [email protected] | Source CodeVendor |
| https://github.com/middleapi/orpc/releases/tag/v1.14.8 | [email protected] | Release NotesVendor |
| https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| middleapi oRPC | <= 1.14.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |