Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M

CVE-2026-77360oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Medium 6.3

In plain English

A medium-severity security flaw in orpc from middleapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@orpc/server1.14.8GHSA-j9v4-rhgr-4m5f

Affected products (as reported)

VendorProductVersions
middleapi orpc < 1.14.8

Weakness: CWE-113 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References