Skip to content
Mmiddleapi
Products
| Product | CVEs | Exploited | Latest |
|---|
| orpc | 5 | – | Oct 2, 2026 |
Exploited and recent CVEs
-
CVE-2026-103918
Medium 6.5
@orpc/zod: Prototype injection in smart coercion
0.2%
-
CVE-2026-103036
Medium 6.5
@orpc/json-schema: Prototype injection in smart coercion
0.2%
-
CVE-2026-77360
Medium 6.3
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
0.5%
-
CVE-2026-33331
High 8.2
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
0.3%
-
CVE-2026-28794
Critical 9.3
oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization
1.1%