Prototype Pollution Vulnerability in oRPC by MiddleAPI

CVE-2026-28794

What is CVE-2026-28794?

CVE-2026-28794 is a vulnerability found in the oRPC tool developed by MiddleAPI, which is designed to facilitate the creation of APIs that are both end-to-end type-safe and compliant with OpenAPI standards. This vulnerability affects the JSON deserializer within the @orpc/client package prior to version 1.13.6. Specifically, it involves a prototype pollution flaw that enables unauthenticated remote attackers to inject arbitrary properties into the global Object.prototype. The consequence of this vulnerability is substantial, as the pollution persists for the duration of the Node.js process and impacts all objects, potentially opening doors to serious security breaches, such as authentication bypass, denial of service (DoS), and even remote code execution (RCE). Due to its potential severity, this flaw poses significant risks to organizations that rely on affected versions of oRPC for their API development.

Potential Impact of CVE-2026-28794

1. Authentication Bypass: The vulnerability may allow attackers to bypass authentication measures, which can lead to unauthorized access to sensitive systems and data.

2. Denial of Service (DoS): The ability to alter global object properties could result in service disruptions, making applications unavailable to legitimate users and negatively impacting business operations.

3. Remote Code Execution (RCE): If exploited, this could potentially allow attackers to execute arbitrary code on affected systems, leading to complete system compromise and exposing critical assets to further attacks.

References