Skip to content
Heist/ feed
Back to feed
Medium

@orpc/json-schema: Prototype injection in smart coercion

Type: advisorySources: OSV

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-103036
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 06:03 UTC · Revision 1

Source evidence

@orpc/json-schema: Prototype injection in smart coercion

core-osv · Original source

Published 2 Oct 2026, 19:59 UTC

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.

osv:CVE-2026-103036
Complete source record
{
  "id": "35da1419ecb9720db8b2f61ac3e46899c642b30b3930db9380cf0c6097d6917c",
  "url": "https://osv.dev/vulnerability/CVE-2026-103036",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "@orpc/json-schema: Prototype injection in smart coercion",
    "summary": "oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.",
    "evidence": "osv:CVE-2026-103036",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-103036",
      "aliases": [
        "CVE-2026-103036",
        "GHSA-4h5r-cv8j-4456"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/middleapi/orpc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4dd5133c3a7597482021c8c9e9dffb4a06a8518c"
                },
                {
                  "fixed": "8a352622e756e8956311f5836cd5c5b9219c0666"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.14.9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "8a352622e756e8956311f5836cd5c5b9219c0666"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4dd5133c3a7597482021c8c9e9dffb4a06a8518c"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.14.9"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.14.8",
            "v1.14.7",
            "v1.14.6",
            "v1.14.5",
            "v1.14.4",
            "v1.14.3",
            "v1.14.2",
            "v1.14.1",
            "v1.14.0",
            "v1.13.14",
            "v1.13.13",
            "v1.13.12",
            "v1.13.11",
            "v1.13.10",
            "v1.13.9",
            "v1.13.8",
            "v1.13.7",
            "v1.13.6",
            "v1.13.5",
            "v1.13.4",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.3",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.10.4",
            "v1.10.3",
            "v1.10.2",
            "v1.10.1",
            "v1.10.0",
            "v1.9.4",
            "v1.9.3",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0",
            "v1.8.9",
            "v1.8.8",
            "v1.8.7",
            "v1.8.6",
            "v1.8.5",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.11",
            "v1.7.10",
            "v1.7.9",
            "v1.7.8",
            "v1.7.7",
            "v1.7.6",
            "v1.7.5",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.3",
            "v1.0.0-beta.7",
            "v0.54.0",
            "v1.0.0-beta.6",
            "v0.53.0",
            "v1.0.0-beta.5",
            "v0.52.0",
            "v1.0.0-beta.4",
            "v0.51.0",
            "v1.0.0-beta.3",
            "v0.50.0",
            "v1.0.0-beta.2",
            "v0.49.0",
            "v0.48.0",
            "v1.0.0-beta.1",
            "v0.47.0",
            "v0.46.0",
            "v0.45.1",
            "v0.45.0",
            "v0.44.0",
            "v0.43.0",
            "v0.42.0",
            "v0.41.2",
            "v0.41.1",
            "v0.41.0",
            "v0.40.0",
            "v0.39.0",
            "v0.38.0",
            "v0.37.0",
            "v0.36.1",
            "v0.36.0",
            "v0.35.1",
            "v0.35.0",
            "v0.34.0",
            "v0.33.0",
            "v0.32.0",
            "v0.31.0",
            "v0.30.0",
            "v0.29.0",
            "v0.28.0",
            "v0.27.0",
            "v0.26.0",
            "v0.25.0",
            "v0.24.0",
            "v0.23.0",
            "v0.22.0",
            "v0.21.0",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.0",
            "v0.12.0",
            "v0.11.0",
            "v0.10.0",
            "v0.10.0-beta.1",
            "v0.9.0",
            "v0.9.0-beta.1",
            "v0.8.0",
            "v0.8.0-beta.1",
            "v0.8.0-alpha.2",
            "v0.8.0-alpha.1",
            "v0.7.0",
            "v0.6.0",
            "@orpc/server@0.4.0",
            "@orpc/openapi@0.0.11",
            "@orpc/zod@0.0.2",
            "@orpc/transformer@0.0.6",
            "@orpc/shared@0.1.1",
            "@orpc/server@0.3.1",
            "@orpc/react@0.0.7",
            "@orpc/openapi@0.0.10",
            "@orpc/contract@0.1.3",
            "@orpc/client@0.0.6",
            "@orpc/transformer@0.0.5",
            "@orpc/shared@0.1.0",
            "@orpc/server@0.3.0",
            "@orpc/react@0.0.6",
            "@orpc/openapi@0.0.9",
            "@orpc/contract@0.1.2",
            "@orpc/client@0.0.5",
            "@orpc/server@0.2.1",
            "@orpc/react@0.0.5",
            "@orpc/openapi@0.0.8",
            "@orpc/contract@0.1.1",
            "@orpc/client@0.0.4",
            "@orpc/server@0.2.0",
            "@orpc/react@2.0.0",
            "@orpc/openapi@0.0.7",
            "@orpc/contract@0.1.0",
            "@orpc/client@2.0.0",
            "@orpc/server@0.1.2",
            "@orpc/react@1.0.2",
            "@orpc/openapi@0.0.6",
            "@orpc/client@1.0.2",
            "@orpc/zod@0.0.1",
            "@orpc/transformer@0.0.4",
            "@orpc/shared@0.0.5",
            "@orpc/server@0.1.0",
            "@orpc/react@1.0.0",
            "@orpc/openapi@0.0.4",
            "@orpc/contract@0.0.4",
            "@orpc/client@1.0.0",
            "@orpc/react@0.0.4",
            "@orpc/transformer@0.0.3",
            "@orpc/shared@0.0.4",
            "@orpc/server@0.0.3",
            "@orpc/react@0.0.3",
            "@orpc/openapi@0.0.3",
            "@orpc/contract@0.0.3",
            "@orpc/client@0.0.3",
            "@orpc/transformer@0.0.2",
            "@orpc/shared@0.0.3",
            "@orpc/server@0.0.2",
            "@orpc/react@0.0.2",
            "@orpc/openapi@0.0.2",
            "@orpc/contract@0.0.2",
            "@orpc/client@0.0.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103036.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.905353706Z",
      "provider": "osv",
      "references": [
        "https://github.com/middleapi/orpc/releases/tag/v1.14.9",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103036.json",
        "https://github.com/middleapi/orpc/security/advisories/GHSA-4h5r-cv8j-4456",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-103036",
        "https://github.com/middleapi/orpc/commit/8a352622e756e8956311f5836cd5c5b9219c0666",
        "https://github.com/middleapi/orpc/pull/1726"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1321",
          "CWE-915"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103036.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-103036",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 510881,
  "published_at": "2026-10-02T19:59:23.947+00:00"
}