Description
A flaw in the CORS plugin allowed the incoming request’s Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server.
Recommendation
Update the @orpc/server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.14.7
- Patched version(s): 1.14.8
References
Could your website be exposed too?
SmartScanner can check your website for oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
- Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM - CVE-2026-73089
You might also like:
See something that needs correcting? Let us knowUpdated September 17, 2026