CVE-2026-103918

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103918
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103918.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103918
Aliases
Published
2026-10-02T20:02:50Z
Modified
2026-10-06T02:30:44Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
@orpc/zod: Prototype injection in smart coercion
Details

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply proto to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and proto can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321",
        "CWE-915"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103918.json"
}
References

Affected packages

Git / github.com/middleapi/orpc

Affected ranges

Type
GIT
Repo
https://github.com/middleapi/orpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26314dfb443237c495116c5794d3d30a7a22c570
Fixed
a8dd6da781b7f21337cdcb3cd66db293638b1fbe
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.14.10"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@orpc/client@0.*
@orpc/client@0.0.2
@orpc/client@0.0.3
@orpc/client@0.0.4
@orpc/client@0.0.5
@orpc/client@0.0.6
@orpc/client@1.*
@orpc/client@1.0.0
@orpc/client@1.0.2
@orpc/client@2.*
@orpc/client@2.0.0
@orpc/contract@0.*
@orpc/contract@0.0.2
@orpc/contract@0.0.3
@orpc/contract@0.0.4
@orpc/contract@0.1.0
@orpc/contract@0.1.1
@orpc/contract@0.1.2
@orpc/contract@0.1.3
@orpc/openapi@0.*
@orpc/openapi@0.0.10
@orpc/openapi@0.0.11
@orpc/openapi@0.0.2
@orpc/openapi@0.0.3
@orpc/openapi@0.0.4
@orpc/openapi@0.0.6
@orpc/openapi@0.0.7
@orpc/openapi@0.0.8
@orpc/openapi@0.0.9
@orpc/react@0.*
@orpc/react@0.0.2
@orpc/react@0.0.3
@orpc/react@0.0.4
@orpc/react@0.0.5
@orpc/react@0.0.6
@orpc/react@0.0.7
@orpc/react@1.*
@orpc/react@1.0.0
@orpc/react@1.0.2
@orpc/react@2.*
@orpc/react@2.0.0
@orpc/server@0.*
@orpc/server@0.0.2
@orpc/server@0.0.3
@orpc/server@0.1.0
@orpc/server@0.1.2
@orpc/server@0.2.0
@orpc/server@0.2.1
@orpc/server@0.3.0
@orpc/server@0.3.1
@orpc/server@0.4.0
@orpc/shared@0.*
@orpc/shared@0.0.3
@orpc/shared@0.0.4
@orpc/shared@0.0.5
@orpc/shared@0.1.0
@orpc/shared@0.1.1
@orpc/transformer@0.*
@orpc/transformer@0.0.2
@orpc/transformer@0.0.3
@orpc/transformer@0.0.4
@orpc/transformer@0.0.5
@orpc/transformer@0.0.6
@orpc/zod@0.*
@orpc/zod@0.0.1
@orpc/zod@0.0.2
v0.*
v0.10.0
v0.10.0-beta.1
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.36.1
v0.37.0
v0.38.0
v0.39.0
v0.40.0
v0.41.0
v0.41.1
v0.41.2
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.8.0-alpha.1
v0.8.0-alpha.2
v0.8.0-beta.1
v0.9.0
v0.9.0-beta.1
v1.*
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.3
v1.1.0
v1.1.1
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.10
v1.13.11
v1.13.12
v1.13.13
v1.13.14
v1.13.2
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.14.9
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103918.json"