https://vulnerability.circl.lu/sightings/feed 2026-10-08T12:35:51.180095+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/afe7cde7-d815-4051-90f5-0a6ed0339737/export 2026-10-08T12:35:51.257129+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "afe7cde7-d815-4051-90f5-0a6ed0339737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103918", "type": "seen", "source": "https://gist.github.com/alon710/88d554e1853a82784ea564c04bdf9f6c", "content": "# CVE-2026-103918: CVE-2026-103918: Prototype Injection and Denial of Service in oRPC @orpc/zod Smart Coercion Engine\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-103918\n\n## Summary\nCVE-2026-103918 is a medium-severity vulnerability within the @orpc/zod smart coercion plugin in oRPC. Prior to version 1.14.10, the package fails to sanitize untrusted input keys when performing pre-validation type coercion, allowing prototype injection on the returned request object and Denial of Service.\n\n## TL;DR\nA prototype injection and denial of service vulnerability in oRPC's @orpc/zod pre-validation coercion engine enables request object prototype modification and unhandled TypeError crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915 / CWE-1321\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00234\n- **Impact**: Prototype Pollution / Denial of Service\n- **Exploit Status**: PoC available in test cases\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- oRPC\n- @orpc/zod\n- middleapi orpc\n- **@orpc/zod**: < 1.14.10 (Fixed in: `1.14.10`)\n\n## Mitigation\n\n- Upgrade @orpc/zod to version 1.14.10 or higher.\n- Sanitize untrusted input keys prior to oRPC coercion to filter out __proto__ and constructor properties.\n\n**Remediation Steps:**\n1. Run 'npm install @orpc/zod@1.14.10' or update the package.json file to require version 1.14.10.\n2. Verify the installation using 'npm list @orpc/zod'.\n3. Deploy input-sanitizing WAF rules if immediate patching is not possible.\n\n## References\n\n- [GitHub Security Advisory GHSA-gcgf-fh7c-8gf2](https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2)\n- [oRPC Pull Request #1727](https://github.com/middleapi/orpc/pull/1727)\n- [Fix Commit 26314df](https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570)\n- [oRPC Release v1.14.10](https://github.com/middleapi/orpc/releases/tag/v1.14.10)\n- [CVE Record CVE-2026-103918](https://www.cve.org/CVERecord?id=CVE-2026-103918)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-103918)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-103918) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T20:30:32.000000Z"} 2026-10-05T20:30:32+00:00