CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

Summary

A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server.

Details

The CORS plugin previously copied the request's Vary header directly onto the response instead of treating Vary as a response-only header. Because Vary tells downstream caches and proxies how to key their cached responses, this allowed a client to inject arbitrary values into the response's Vary header, potentially distorting cache-key behavior in shared caches/CDNs sitting in front of an oRPC server and leading to inconsistent CORS enforcement for other clients.

Practical impact is limited to deployments where a shared cache or reverse proxy keys on the Vary header; the real-world effect depends on the caching layer's configuration.

Impact

May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on Vary. No direct confidentiality, integrity, or availability impact in default (non-cached) configurations.

Resolution

Update @orpc/server (and any other @orpc/* packages bundling the CORS plugin) to 1.14.8. The CORS plugin now derives Vary exclusively from the response, appending Origin and preserving existing values instead of reflecting request headers.

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.

Summary

A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server.

Details

The CORS plugin previously copied the request's Vary header directly onto the response instead of treating Vary as a response-only header. Because Vary tells downstream caches and proxies how to key their cached responses, this allowed a client to inject arbitrary values into the response's Vary header, potentially distorting cache-key behavior in shared caches/CDNs sitting in front of an oRPC server and leading to inconsistent CORS enforcement for other clients.

Practical impact is limited to deployments where a shared cache or reverse proxy keys on the Vary header; the real-world effect depends on the caching layer's configuration.

Impact

May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on Vary. No direct confidentiality, integrity, or availability impact in default (non-cached) configurations.

Resolution

Update @orpc/server (and any other @orpc/* packages bundling the CORS plugin) to 1.14.8. The CORS plugin now derives Vary exclusively from the response, appending Origin and preserving existing values instead of reflecting request headers.