GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: OSV:GHSA-GCGF-FH7C-8GF2...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: GHSA-GCGF-FH7C-8GF2...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: MEND:CVE-2026-103918...

CVE-2026-103918

The oRPC tool is vulnerable to prototype pollution in versions prior to 1.14.10 due to how the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin handle object and record properties. The root cause lies in resolving shape keys through the prototype chain , which allows a rem...

PT-2026-104428

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.10 Description The @orpc/zod ZodSmartCoercionPlugin and experimental ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client c...

CVE-2026-103918: Improperly Controlled Modification of Dynamically-Determined Object Attributes

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...