{"action":"Upgrade @orpc/zod to 1.14.10 or later.","affected":[{"fixed":"1.14.10","introduced":"0"}],"component":"@orpc/zod","cve_ids":["CVE-2026-103918"],"ecosystem":"npm","epss":0.00248,"exploited":false,"fixed_versions":["1.14.10"],"ghsa_id":"GHSA-gcgf-fh7c-8gf2","id":"tcs_01M5KFRB69K8A4QT5B7QE46Q84","modified_at":"2026-10-05T17:45:04.336870149Z","published_at":"2026-10-05T17:32:32Z","references":["https://osv.dev/vulnerability/GHSA-gcgf-fh7c-8gf2","https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2","https://nvd.nist.gov/vuln/detail/CVE-2026-103918","https://github.com/middleapi/orpc/pull/1727","https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570","https://github.com/middleapi/orpc","https://github.com/middleapi/orpc/releases/tag/v1.14.10"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gcgf-fh7c-8gf2","url":"https://osv.dev/vulnerability/GHSA-gcgf-fh7c-8gf2"}],"summary":"@orpc/zod: Prototype injection in smart coercion"}