middleapi oRPC up to 1.14.9 ZodSmartCoercionPlugin __proto__ improperly controlled sequential memory allocation

Summaryinfo

A vulnerability identified as critical has been detected in middleapi oRPC up to 1.14.9. This issue affects some unknown processing of the component ZodSmartCoercionPlugin. The manipulation of the argument __proto__ leads to improperly controlled sequential memory allocation. This vulnerability is traded as CVE-2026-103918. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in middleapi oRPC up to 1.14.9. This issue affects some unknown functionality of the component ZodSmartCoercionPlugin. The manipulation of the argument __proto__ with an unknown input leads to a improperly controlled sequential memory allocation vulnerability. Using CWE to declare the problem leads to CWE-1325. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-103918 since 10/01/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.14.10 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• middleapi

Name

• oRPC

Version

• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.14.5
• 1.14.6
• 1.14.7
• 1.14.8
• 1.14.9

Website

• Product: https://github.com/middleapi/orpc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion