Read the docs
TI-2026-22989 Aliases CVE-2026-28794GHSA-m272-9rp6-32mc

oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization

Priority HIGH 81CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01058 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed orpc (middleapi): 1.13.6@orpc/client (npm): 1.13.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
middleapiorpcbefore 1.13.61.13.6Patch availableCNA
—@orpc/client (npm)before 1.13.61.13.6Patch availableGHSA-m272-9rp6-32mc
  • orpc Vendormiddleapi Affected before 1.13.6 Fixed in 1.13.6 Patch available CNA
  • @orpc/client (npm) Vendor— Affected before 1.13.6 Fixed in 1.13.6 Patch available GHSA-m272-9rp6-32mc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*before 1.13.6VulnerableOrpc
  • cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:* Versions before 1.13.6 Vulnerable ·Orpc

Remediation

  • Fix · CNA orpc (middleapi) Fixed in 1.13.6
  • Fix · GHSA-m272-9rp6-32mc @orpc/client (npm) Fixed in 1.13.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28794
  2. 2026-10-03 Alias added: GHSA-m272-9rp6-32mc

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-53979 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass CVSS 4.0MEDIUM 6.3
  • TI-2026-66040 @orpc/zod: Prototype injection in smart coercion CVSS 3.1MEDIUM 6.5
  • TI-2026-66014 @orpc/json-schema: Prototype injection in smart coercion CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences