oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

### Summary A flaw in the CORS plugin allowed the incoming request's `Vary` header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. ### Details The CORS plugin previously copied the request's `Vary` header directly onto the response instead of treating `Vary` as a response-only header. Because `Vary` tells downstream caches and proxies how to key their cached responses, this allowed a client to inject arbitrary values into the response's `Vary` header, potentially distorting cache-key behavior in shared caches/CDNs sitting in front of an oRPC server and leading to inconsistent CORS enforcement for other clients. Practical impact is limited to deployments where a shared cache or reverse proxy keys on the `Vary` header; the real-world effect depends on the caching layer's configuration. ### Impact May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on `Vary`. No direct confidentiality, integrity, or availability impact in default (non-cached) configurations. ### Resolution Update `@orpc/server` (and any other `@orpc/*` packages bundling the CORS plugin) to `1.14.8`. The CORS plugin now derives `Vary` exclusively from the response, appending `Origin` and preserving existing values instead of reflecting request headers.

Source published

17 Sep 2026 14:52:37 UTC

Source modified

17 Sep 2026 15:00:05 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Publisher rating · MODERATE