CVE-2026-103036: oRPC JSON Schema Prototype Pollution RCE

CVE-2026-103036 Overview

CVE-2026-103036 is a prototype injection vulnerability in oRPC, a TypeScript library for building end-to-end type-safe APIs that conform to OpenAPI standards. The flaw resides in the @orpc/json-schema SmartCoercionPlugin, which uses JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. Remote clients that can reach a procedure accepting an object input schema can inject __proto__ or Object.prototype member names such as constructor and toString to influence coerced request objects. The issue is fixed in oRPC version 1.14.9.

Critical Impact

Attacker-controlled inherited properties can affect handler logic, Object.assign operations, and configuration lookups, while legitimate __proto__ properties supplied by clients are silently dropped.

Affected Products

• oRPC @orpc/json-schema package prior to version 1.14.9
• Applications using the SmartCoercionPlugin with object input schemas
• Services exposing oRPC procedures to untrusted remote clients

Discovery Timeline

• 2026-10-02 - CVE-2026-103036 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103036

Vulnerability Analysis

The vulnerability is classified as improperly controlled modification of object prototype attributes [CWE-915]. The JsonSchemaCoercer in oRPC collects object properties into a plain JavaScript object and then resolves schema.properties entries via normal property access. Because plain objects inherit from Object.prototype, lookups for property names that are not own properties fall through to inherited members. An attacker supplying payload keys such as constructor or toString causes the coercer to treat inherited function references as valid sub-schemas, bypassing the satisfaction check intended to validate structural inputs.

The advisory clarifies that the global Object.prototype is not mutated, and that unrelated objects, concurrent requests, and other users remain unaffected. Downstream schema validation still runs after coercion, so the practical impact depends on how the application consumes the coerced object before validation completes.

Root Cause

The root cause is the use of a plain object (inheriting from Object.prototype) as the accumulator for coerced request properties, combined with property lookups that do not distinguish own properties from inherited ones. The patch replaces the plain object with a null-prototype object (NullProtoObj) imported from @orpc/shared, eliminating the inherited member surface.

Attack Vector

An unauthenticated remote attacker who can send a request to any oRPC procedure that accepts an object input schema can craft a JSON payload containing __proto__, constructor, or toString keys. During coercion, inherited properties of the request object are treated as attacker-controlled sub-schema data and flow into handler logic, Object.assign merges, or configuration lookups downstream.

 import type { JsonSchema } from './types'
-import { guard, isObject, toArray } from '@orpc/shared'
+import { guard, isObject, NullProtoObj, toArray } from '@orpc/shared'
 import { JsonSchemaXNativeType } from './types'
 
 const FLEXIBLE_DATE_FORMAT_REGEX = /^[^-]+-[^-]+-[^-]+$/

Source: GitHub Commit 8a35262. The patch introduces NullProtoObj for the coercion accumulator, preventing prototype chain lookups from returning inherited members.

Detection Methods for CVE-2026-103036

Indicators of Compromise

• Inbound request payloads containing JSON keys named __proto__, constructor, or toString targeting oRPC procedure endpoints
• Application logs showing unexpected handler behavior, configuration overrides, or anomalous values appearing in Object.assign merges tied to specific requests
• Deployed versions of @orpc/json-schema prior to 1.14.9 identified through software composition analysis

Detection Strategies

• Perform dependency scanning against lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to flag @orpc/json-schema releases below 1.14.9
• Inspect reverse proxy or API gateway logs for request bodies containing reserved prototype keys and alert on patterns targeting oRPC routes
• Add runtime assertions in request handlers to detect inherited property access on coerced inputs during pre-production testing

Monitoring Recommendations

• Enable structured logging of oRPC procedure inputs with redaction, allowing retroactive searches for prototype-pollution key patterns
• Monitor exception rates and handler latency for oRPC endpoints following suspected probing activity
• Correlate web application firewall alerts for __proto__ and constructor payloads with downstream service telemetry

How to Mitigate CVE-2026-103036

Immediate Actions Required

• Upgrade @orpc/json-schema and the oRPC toolchain to version 1.14.9 or later across all services
• Audit all procedures that use the SmartCoercionPlugin with object input schemas and prioritize patching those reachable from untrusted networks
• Review handler code that performs Object.assign, dynamic property access, or configuration merges on coerced inputs for exploitation evidence

Patch Information

The fix is published in oRPC v1.14.9. See the GitHub Release v1.14.9, the GitHub Pull Request #1726, and the GitHub Security Advisory GHSA-4h5r-cv8j-4456 for complete remediation details.

Workarounds

• Deploy a web application firewall or reverse proxy rule that rejects JSON request bodies containing top-level __proto__, constructor, or toString keys targeting oRPC endpoints
• Temporarily disable the SmartCoercionPlugin on procedures that accept object input schemas until the upgrade is deployed
• Add pre-handler middleware that strips reserved prototype keys from inbound payloads before they reach the coercer

# Upgrade @orpc/json-schema to the patched release
npm install @orpc/json-schema@1.14.9
# or
pnpm add @orpc/json-schema@1.14.9
# or
yarn add @orpc/json-schema@1.14.9