{"id":"CVE-2026-103918","revision":null,"records":[{"revision":"98dff39a6fdb47159ed0e0c538951f36","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103918","aliases":[],"title":"@orpc/zod: Prototype injection in smart coercion","description":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.","state":0,"publishedAt":"2026-10-02T20:02:50.946+00:00","modifiedAt":"2026-10-05T17:19:02.554+00:00","affected":[{"ecosystem":"Vendor product","name":"orpc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"middleapi\",\n                    \"product\": \"orpc\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.14.10\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2","https://github.com/middleapi/orpc/pull/1727","https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570","https://github.com/middleapi/orpc/releases/tag/v1.14.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103918","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103918","identifiers":["CVE-2026-103918"]},"retained":false,"historicalAffected":[]},{"revision":"aed8008076ce4e15a21d566c7c48c53c","observedAt":"2026-11-11T05:29:53.985+00:00","statement":{"source":"euvd","id":"EUVD-2026-91793","aliases":["CVE-2026-103918","GHSA-gcgf-fh7c-8gf2"],"title":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain…","description":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":null}],"references":["https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2","https://github.com/middleapi/orpc/pull/1727","https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570","https://github.com/middleapi/orpc/releases/tag/v1.14.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91793","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 2, 2026, 8:02:50 PM","dateUpdated":"Oct 5, 2026, 5:19:02 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-91793","identifiers":["EUVD-2026-91793","CVE-2026-103918","GHSA-gcgf-fh7c-8gf2"]},"retained":false,"historicalAffected":[]},{"revision":"730da4450d1e4a19a3351d39186a9276","observedAt":"2026-10-25T04:17:29.458+00:00","statement":{"source":"nvd","id":"CVE-2026-103918","aliases":[],"title":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain…","description":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.","state":0,"publishedAt":"2026-10-02T20:17:00.067+00:00","modifiedAt":"2026-10-06T15:18:12.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570","https://github.com/middleapi/orpc/pull/1727","https://github.com/middleapi/orpc/releases/tag/v1.14.10","https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103918","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-915","CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-10-02T20:17:00.067","lastModified":"2026-10-06T15:18:12.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-103918","identifiers":["CVE-2026-103918"]},"retained":false,"historicalAffected":[]},{"revision":"86c8a89ab5bf420a8f5c2b21d73bb34b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gcgf-fh7c-8gf2","aliases":["CVE-2026-103918"],"title":"@orpc/zod: Prototype injection in smart coercion","description":"## Summary\n\n`ZodSmartCoercionPlugin` and `experimental_ZodSmartCoercionPlugin` mishandle object keys that name `Object.prototype` members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can:\n\n1. replace the prototype of the coerced input object, and\n2. make a request fail with an unhandled `TypeError` by sending a key such as `constructor`.\n\nThis is the same class of bug as GHSA-4h5r-cv8j-4456 in `@orpc/json-schema`, in a different package.\n\n## This is not global prototype pollution\n\n**The global `Object.prototype` is never modified.** No shared or global state is written, so other objects in the process, other requests, and other users are not affected.\n\nWhat changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary `{}` created anywhere else in the application is unaffected.\n\n## Details\n\n### 1. `__proto__` replaces the prototype of the coerced value\n\nCoerced properties were collected into a plain `{}`, so `newObj['__proto__'] = value` triggers the inherited `__proto__` setter instead of creating an own property. Verified on 1.14.8 against a record schema, in both plugins:\n\n```\nschema: z.record(z.string())\ninput:  {\"a\":\"1\",\"__proto__\":{\"polluted\":true}}\n\nObject.keys(result)  => [\"a\"]      // the __proto__ entry is dropped from the output\nresult.polluted      => true       // the attacker object is now this object's prototype\n({}).polluted        => undefined  // Object.prototype is untouched\n```\n\nThe returned value inherits attacker controlled properties, and any consumer reading them through the prototype chain, such as a handler checking `input.isAdmin`, an `Object.assign` copy, or a config lookup, sees data the client never legitimately supplied. How far that goes depends on what the application does with the coerced input. There is no generic escalation path.\n\nThis affects the `record` branch of both plugins, and the `object` branch of both plugins for any key that does not first trigger the error below.\n\n### 2. Sub-schemas resolved through the prototype chain\n\nThe `object` branch looked up sub-schemas with `shape[key]`, which returns inherited members for keys such as `constructor`, `toString` and `__proto__`. Those values, for example the `Object` constructor, were then dereferenced as Zod schemas:\n\n```\nschema: z.object({ a: z.number() })\ninput:  { a: '123', constructor: '456' }\n\nzod 3 => TypeError: Cannot read properties of undefined (reading 'Symbol(ORPC_CUSTOM_ZOD_DEF)')\nzod 4 => TypeError: Cannot read properties of undefined (reading 'def')\n```\n\nCoercion throws before the assignment, so for object schemas these keys break the request rather than injecting a prototype. Any client can trigger this on its own requests. It does not affect other clients or the process as a whole.\n\n## Impact\n\nAny oRPC server that installs `ZodSmartCoercionPlugin` or `experimental_ZodSmartCoercionPlugin` from `@orpc/zod` and has at least one procedure whose input schema contains an object or a record. No authentication or user interaction is required beyond what the procedure itself demands.\n\nThe effect is scoped to the request that sent the payload. Because no global state is written, one request cannot influence another, and restarting the process is not needed to recover.\n\n## Patch\n\nFixed in 1.14.10.\n\nIn `packages/zod/src/coercer.ts` and `packages/zod/src/zod4/coercer.ts`:\n\n- collect coerced object and record properties into `NullProtoObj`, the null prototype helper already used for untrusted keys in `bracket-notation.ts` and `rpc-matcher.ts`, so `__proto__` stays an ordinary own property and is preserved in the output\n- guard the shape lookup with `Object.hasOwn`, so unknown keys fall through to `catchall` as they already do for every other name\n\nPR: middleapi/orpc#1727\n\n## Workarounds\n\nReject or strip request payloads containing `__proto__`, `constructor` or `prototype` keys before they reach the handler, or remove the plugin if automatic coercion is not required.\n\nNote that `SmartCoercionPlugin` from `@orpc/json-schema`, the recommended replacement for these plugins, was affected by the same class of issue (GHSA-4h5r-cv8j-4456) and is fixed in the same release.\n\n## Credit\n\nReported and fixed internally.","state":0,"publishedAt":"2026-10-05T17:32:32+00:00","modifiedAt":"2026-10-05T17:45:04.3368701+00:00","affected":[{"ecosystem":"npm","name":"@orpc/zod","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.14.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2","https://nvd.nist.gov/vuln/detail/CVE-2026-103918","https://github.com/middleapi/orpc/pull/1727","https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570","https://github.com/middleapi/orpc","https://github.com/middleapi/orpc/releases/tag/v1.14.10"],"sourceUrl":"https://github.com/advisories/GHSA-gcgf-fh7c-8gf2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gcgf-fh7c-8gf2","identifiers":["GHSA-gcgf-fh7c-8gf2","CVE-2026-103918"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T14:57:42.7555955+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T14:57:42.7555955+00:00","lastSuccessAt":"2026-11-11T14:57:42.9319568+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.9319577+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-19109df301f45af5f6ac2ef04012c27245f9ad888d1e548bcdb48fe76d9f96e6","complete":true,"records":424146,"lastAttemptAt":"2026-11-11T14:57:42.3158203+00:00","lastSuccessAt":"2026-11-11T14:57:42.1205118+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.3158203+00:00","snapshotPublishedAt":"2026-11-11T14:27:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-daa70f0e05b540b28ec429806bdccfc4","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T15:09:37.2726122+00:00","lastSuccessAt":"2026-11-11T15:09:37.269+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:09:37.269+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13582,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T14:57:42.7555955+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T14:57:42.7555955+00:00","lastSuccessAt":"2026-11-11T14:57:42.9331503+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.9331505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-11785b13898646a1917b06b09d2df4a4","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T14:57:44.6046058+00:00","lastSuccessAt":"2026-11-11T13:57:34.909+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:34.909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T14:57:42.5803744+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.5803744+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T14:57:42.3614093+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.3614093+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T14:57:42.6953487+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.6953487+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-10cb353ca77c2a8069d6892d1d394d936b12c0add3c8749e2a1a03a1c5d50426","complete":true,"records":231666,"lastAttemptAt":"2026-11-11T14:57:42.4738411+00:00","lastSuccessAt":"2026-11-11T12:59:55.8981437+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:57:42.4738411+00:00","snapshotPublishedAt":"2026-11-11T12:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}