middleapi orpc

• CVE-2026-103918 Medium 6.5 @orpc/zod: Prototype injection in smart coercion 0.2%
• CVE-2026-103036 Medium 6.5 @orpc/json-schema: Prototype injection in smart coercion 0.2%
• CVE-2026-77360 Medium 6.3 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass 0.5%
• CVE-2026-33331 High 8.2 oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify 0.3%
• CVE-2026-28794 Critical 9.3 oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization 1.1%