oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.

Affected: npm: @orpc/zod

## Summary

`ZodSmartCoercionPlugin` and `experimental_ZodSmartCoercionPlugin` mishandle object keys that name `Object.prototype` members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can:

1. replace the prototype of the coerced input object, and 2. make a request fail with an unhandled `TypeError` by sending a key such as `constructor`.

This is the same class of bug as GHSA-4h5r-cv8j-4456 in `@orpc/json-schema`, in a different package.

## This is not global prototype pollution

**The global `Object.prototype` is never modified.** No shared or global state is written, so other objects in the process, other requests, and other users are not affected.

What changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary `{}` created anywhere else in the application is unaffected.

## Details

### 1. `__proto__` replaces the prototype of the coerced value

Coerced properties were collected into a plain `{}`, so `newObj['__proto__'] = value` triggers the inherited `__proto__` setter instead of creating an own property. Verified on 1.14.8 against a record schema, in both plugins:

``` schema: z.record(z.string()) input: {"a":"1","__proto__":{"polluted":true}}

Object.keys(result) => ["a"] // the __proto__ entry is dr…