@ait-kit/api-orpc (>=0.1.0, <=0.2.0), @amqp-contract/asyncapi (>=0.2.0, <=2.4.0) +68 more potentially affected by CVE-2026-77360 via @orpc/server (>=1.0.0-beta.1, <=1.14.7)

@orpc/server NPM version =1.0.0-beta.1, =0.1.0, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =1.8.6 - @conciv/cli 0.0.19 - @conciv/core 0.0.19 - @conciv/embed 0.0.19 - @conciv/extension 0.0.19 - @conciv/extension-compil...

@ait-kit/api-orpc (>=0.1.0, <=0.2.0), @amqp-contract/asyncapi (>=0.2.0, <=2.4.0) +68 more potentially affected by CVE-2026-77360 via @orpc/server (>=1.0.0-beta.1, <=1.14.7)

@orpc/server NPM version =1.0.0-beta.1, =0.1.0, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =1.8.6 - @conciv/cli 0.0.19 - @conciv/core 0.0.19 - @conciv/embed 0.0.19 - @conciv/extension 0.0.19 - @conciv/extension-compil...

CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

@ait-kit/api-orpc (>=0.1.0, <=0.2.0), @amqp-contract/asyncapi (>=0.2.0, <=2.4.0) +72 more potentially affected by CVE-2026-77360 via @orpc/server (>=0.0.0, <=1.14.7)

@orpc/server NPM version =0.0.0, =0.1.0, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =1.8.6 - @conciv/cli 0.0.19 - @conciv/core 0.0.19 - @conciv/embed 0.0.19 - @conciv/extension 0.0.19 - @conciv/extension-compiler 0.0....

CVE-2026-77360: Improper Neutralization of CRLF Sequences in HTTP Headers

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

PT-2026-93900

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.8 Description The CORS plugin in the @orpc/server package, specifically within packages/server/src/plugins/cors.ts, incorrectly copies the Vary request header from the client directly into the response. The Vary...