CVE-2026-103036 in orpc
Summary
by MITRE • 10/02/2026
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in oRPC versions prior to 1.14.9 stems from a flawed implementation of the JsonSchemaCoercer within the @orpc/json-schema SmartCoercionPlugin. As an API framework designed for end-to-end type safety and adherence to OpenAPI standards, oRPC relies heavily on strict input validation and coercion mechanisms to ensure that data received from remote clients matches expected schemas. The core technical flaw lies in how the coercer processes object properties during schema resolution. Specifically, when collecting object properties or resolving entries under schema.properties, the implementation fails to adequately distinguish between own enumerable properties of an object and those inherited through its prototype chain. This oversight allows a malicious actor to manipulate the internal state of request processing by injecting specific keys that are typically found on Object.prototype, such as _proto_, constructor, toString, hasOwnProperty, or isPrototypeOf.
From a technical perspective, this behavior constitutes a Prototype Pollution vulnerability, categorized under CWE-1325 within common weakness enumerations. When an attacker supplies the key _proto_ in their request payload, they can effectively replace the prototype of the single coerced request object being processed. Alternatively, by supplying other Object.prototype member names as property keys, the coercer incorrectly treats these inherited values as valid sub-schemas that satisfy its internal checks. This misinterpretation occurs because the coercion logic does not strictly filter out non-enumerable or inherited properties before processing them against the schema definitions. Consequently, attacker-controlled inherited properties can interfere with critical application logic, potentially affecting handler execution paths, Object.assign operations used for merging data structures, or configuration lookups that rely on property existence checks rather than strict value validation.
The operational impact of this vulnerability is significant despite certain mitigating factors present in the oRPC architecture. While the flaw allows an attacker to inject properties into the request object's prototype chain during processing, it does not result in permanent global state corruption. The global Object.prototype remains unmodified, meaning that unrelated objects, other concurrent requests, and users of the application are not directly affected by this specific injection attempt. Furthermore, downstream schema validation continues to run after the coercion phase, which may catch some anomalies before data reaches business logic handlers. However, the immediate side effects include the dropping of legitimate _proto_ properties if they were intended for use within nested object structures that do rely on prototype inheritance in a controlled manner. More critically, the ability to influence handler behavior or configuration lookups through injected inherited properties can lead to unauthorized access patterns, data integrity issues, or denial of service conditions depending on how the specific API endpoints utilize these coerced values.
This vulnerability aligns with ATT&CK technique T1505.003, which involves Server Side Request Forgery via Web Components or similar server-side object manipulation techniques where an attacker modifies internal state to alter application behavior. The root cause is a failure in input validation and sanitization logic, specifically CWE-20: Improper Input Validation, as the system accepts user-controlled data that alters its own structural assumptions about object properties without sufficient verification of property ownership or origin. To mitigate this risk, organizations using oRPC must upgrade to version 1.14.9 or later, where the JsonSchemaCoercer has been patched to correctly ignore inherited properties and prevent prototype manipulation during schema resolution. Until an update is applied, developers should implement additional input sanitization layers that explicitly filter out keys matching Object.prototype members before they reach the oRPC coercion pipeline. This defensive measure ensures that only legitimate, own-enumerable properties are processed according to the defined API schemas, thereby preserving the integrity of type-safe operations and preventing potential exploitation through prototype pollution vectors.