Orpc vulnerabilities

Products

• Orpc 2

Newest

• middleapi orpc oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify CVE-2026-33331 Public exploitFix available 8.2 HighMarch 20, 2026
• middleapi orpc oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization CVE-2026-28794 Fix available 9.3 CriticalMarch 2, 2026