CVE-2026-103918 in oRPC
Summary
by MITRE • 10/02/2026
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in oRPC versions prior to 1.14.10 stems from improper handling of object property resolution within the ZodSmartCoercionPlugin and its experimental counterpart. These plugins are designed to facilitate end-to-end type safety by adhering to OpenAPI standards, but they contain a flaw where input validation logic incorrectly traverses the JavaScript prototype chain when processing object or record inputs. Specifically, the implementation collects properties from plain objects without adequately filtering out inherited members that originate from Object.prototype. This architectural oversight allows a remote client with network access to an affected procedure to inject malicious keys into the request payload. By supplying specific property names such as _proto_, constructor, or toString within the input object, an attacker can manipulate how the server resolves these properties during the validation phase rather than treating them as standard data fields.
The operational impact of this flaw manifests in two distinct ways depending on the schema configuration and the specific keys targeted. In scenarios where the application logic relies on resolving shape keys through the prototype chain to access inherited values, an attacker can supply _proto_ to effectively replace or alter the prototype of the returned request object. This enables the injection of attacker-controlled inherited properties that may subsequently reach internal application lookups, potentially leading to unauthorized data exposure or logic manipulation if those looked-up values are used for security-critical decisions. However, in cases involving strict object schemas where keys like constructor and toString resolve as Zod schema definitions rather than simple property accesses, the immediate result is a validation failure. The system attempts to process these inherited members as part of the structural definition, which triggers an unhandled TypeError during the execution flow. This results in a denial of service for that specific request, causing the API endpoint to return an error response instead of processing valid data.
It is crucial to note that this vulnerability does not constitute a prototype pollution attack in the traditional sense because it does not modify the global Object.prototype or affect unrelated objects and other users within the same process. The scope of impact is strictly limited to the specific request context being processed by the vulnerable procedure. There is no persistent, process-wide state alteration, meaning that one user's malicious input cannot compromise the security posture for subsequent requests from different clients. Nevertheless, the ability to cause unhandled exceptions allows for a targeted denial-of-service vector against individual endpoints. From an industry standard perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if interpreted through the lens of memory safety in underlying engines, though it is primarily categorized under CWE-611 Improper Restriction of XML External Entity References or more accurately CWE-94 Improper Control of Generation of Code when considering the potential for logic bypass. In terms of MITRE ATT&CK, this behavior relates to Taint Analysis failures and potentially Command Injection if the resolved values are executed, though here it is primarily an input validation flaw leading to service disruption.
To mitigate this vulnerability, organizations must upgrade oRPC to version 1.14.10 or later, where the developers have addressed the prototype chain traversal issue by ensuring that inherited properties from Object.prototype are correctly excluded during property collection and resolution. For environments unable to immediately patch, implementing a Web Application Firewall rule to block requests containing _proto_, constructor, or toString within JSON payloads targeting these specific endpoints can provide temporary protection. Additionally, developers should review any custom validation logic that relies on prototype chain traversal for security-sensitive data and enforce strict input sanitization at the API gateway level to prevent malformed objects from reaching the application layer.