CVE-2026-77360
1 advisory.
npm/@orpc/server CVE-2026-77360: medium
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Action: Upgrade @orpc/server to 1.14.8 or later.
npm i @orpc/server@1.14.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.14.8 | - |
Fixed versions
| 1.14.8 |
Sources
- osv: GHSA-j9v4-rhgr-4m5f
- https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f
- https://nvd.nist.gov/vuln/detail/CVE-2026-77360
- https://github.com/middleapi/orpc/issues/1661
- https://github.com/middleapi/orpc/pull/1662
- https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f
- https://github.com/middleapi/orpc
- https://github.com/middleapi/orpc/releases/tag/v1.14.8
CVE-2026-77360 · published · modified · JSON