CVE-2026-77360: oRPC Server CORS Information Disclosure

CVE-2026-77360 Overview

CVE-2026-77360 affects the oRPC library, a tool for building end-to-end type-safe APIs that conform to OpenAPI standards. The @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies the incoming Vary request header directly into the response. This behavior lets a client inject arbitrary variation values into responses cached by shared caches, content delivery networks (CDNs), or reverse proxies. The result is cache key pollution and inconsistent Cross-Origin Resource Sharing (CORS) enforcement for other clients sharing the cache. The issue is classified under [CWE-113] (HTTP Response Splitting / header injection family) and is resolved in oRPC version 1.14.8.

Critical Impact
In deployments behind shared caches or CDNs that key on Vary, an attacker can pollute cache keys and cause inconsistent CORS enforcement across clients.

Affected Products

oRPC @orpc/server package prior to version 1.14.8
Deployments using the oRPC CORS plugin (packages/server/src/plugins/cors.ts)
oRPC services fronted by shared caches, CDNs, or reverse proxies that honor Vary

Discovery Timeline

2026-09-16 - CVE-2026-77360 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
v1.14.8 - Patch released via GitHub Release v1.14.8 and GHSA-j9v4-rhgr-4m5f

Technical Details for CVE-2026-77360

Vulnerability Analysis

The oRPC CORS plugin mishandles the Vary header. Instead of controlling Vary as a response-only header, the plugin reads the client-supplied Vary request header and writes it into the response. The Vary header instructs downstream caches which request headers should factor into cache keys. When an attacker controls its value, they influence how caches segment responses for other users. Attackers can inject nonsense header names or valid but unexpected values to fragment or collide cache entries. Downstream caches then serve responses with incorrect CORS headers to unrelated clients, breaking origin-based access control assumptions.

Root Cause

The root cause is direct propagation of an untrusted request header into a response header without validation. The plugin uses interceptorOptions.request.headers.vary as the response Vary value, defaulting to 'origin' only if absent. A Vary value under attacker control lets a request specify what a cache keys on. The correct behavior is to derive Vary from server logic and always include Origin for origin-varying CORS responses.

Attack Vector

Exploitation requires network access to send crafted HTTP requests to an oRPC endpoint behind a caching layer. The attacker sends a request containing an arbitrary Vary header value. The oRPC server reflects the value into the response. The intermediate cache stores the response keyed by the attacker's chosen headers. Subsequent legitimate clients may receive cached responses with Access-Control-Allow-Origin values that do not match their true origin, degrading CORS enforcement.

typescript

           result.response.headers['access-control-allow-origin'] = origin
         }
 
-        result.response.headers.vary = interceptorOptions.request.headers.vary ?? 'origin'
+        const existingVary = flattenHeader(result.response.headers.vary)
+        if (!existingVary?.split(',').some(v => v.trim().toLowerCase() === 'origin')) {
+          result.response.headers.vary = existingVary ? `${existingVary}, Origin` : 'Origin'
+        }
       }
 
       const allowedTimingOrigin = await value(this.options.timingOrigin, origin, interceptorOptions)
// Source: https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f

The patch stops copying the request Vary header. It reads the existing response Vary, checks whether Origin is already present, and appends Origin if missing. This ensures CORS responses always vary on Origin while ignoring client-controlled input.

Detection Methods for CVE-2026-77360

Indicators of Compromise

HTTP requests to oRPC endpoints containing unusual or attacker-chosen Vary request header values
Cached responses at the CDN or reverse proxy layer showing Vary values that do not include Origin or that include unexpected header names
Client reports of intermittent CORS failures or unexpected Access-Control-Allow-Origin values for the same resource

Detection Strategies

Inspect edge or proxy access logs for inbound Vary headers from clients; legitimate clients do not send Vary on requests.
Compare cached response Vary headers against a known-good allowlist and alert on deviations.
Instrument oRPC servers to log any request where request.headers.vary is set, which is anomalous for browser and API traffic.

Monitoring Recommendations

Enable CDN and reverse proxy logging for the Vary response header and cache key composition.
Track the rate of CORS preflight failures per origin to identify enforcement inconsistencies caused by cache pollution.
Monitor for unexpected cache miss ratios on oRPC routes, which can indicate cache key fragmentation.

How to Mitigate CVE-2026-77360

Immediate Actions Required

Upgrade the @orpc/server package to version 1.14.8 or later across all deployments.
Purge cached responses at any shared cache, CDN, or reverse proxy fronting oRPC services to clear potentially poisoned entries.
Audit CDN and proxy configurations to confirm Vary handling and CORS caching rules match intended policy.

Patch Information

The fix is available in oRPC 1.14.8. See the GitHub Security Advisory GHSA-j9v4-rhgr-4m5f, the patch commit, and Pull Request #1662 for details.

Workarounds

Configure the reverse proxy or CDN to strip inbound Vary request headers before they reach the oRPC application.
Override the response Vary header at the edge to a fixed value that includes Origin for CORS endpoints.
Disable caching for oRPC CORS-enabled routes until the upgrade is deployed.

bash

# Example: strip inbound Vary request header at NGINX and enforce Vary: Origin on responses
proxy_set_header Vary "";
add_header Vary "Origin" always;

# Upgrade oRPC server package
npm install @orpc/server@1.14.8