Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77360— oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Quick assessment

Affected
middleapi orpc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

oRPC 是一个帮助构建端到端类型安全且符合 OpenAPI 标准的 API 开发工具。在 1.14.8 版本之前，位于 中的 CORS 插件存在一个安全漏洞：该插件会将客户端发送的 请求头直接复制到响应中，而不是将 作为仅响应头进行控制，并使用 来表示请求来源的变化维度。 在部署于共享缓存、CDN 或反向代理之后，如果这些中间层依据 头来构建响应缓存键，攻击者（客户端）可以注入任意的 值，从而污染缓存键，导致其他客户端的 CORS 执行出现不一致。在默认的非缓存配置下，该问题尚未被确认会直接导致机密性、完整性或可

CVSS 6.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
middleapi orpc < 1.14.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77360

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP头部中CRLF序列转义处理不恰当(HTTP响应分割)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
middleapi orpc < 1.14.8 -

II. Public POCs for CVE-2026-77360

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77360

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77360 (2)

Other References for CVE-2026-77360 (3)

IV. Related Vulnerabilities

Same product: orpc
Same vendor: middleapi
Same weakness: CWE-113

V. Comments for CVE-2026-77360

No comments yet

Leave a comment