EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918

The oRPC tool is vulnerable to prototype pollution in versions prior to 1.14.10 due to how the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin handle object and record properties. The root cause lies in resolving shape keys through the prototype chain , which allows a rem...

PT-2026-104428

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.10 Description The @orpc/zod ZodSmartCoercionPlugin and experimental ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client c...

CVE-2026-103918: Improperly Controlled Modification of Dynamically-Determined Object Attributes

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...