Medium, CVSS 6.3npmAmendedPublished
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
CVE-2026-77360 · GHSA-j9v4-rhgr-4m5f
- Affected
- npm @orpc/server <= 1.14.7
- Fixed in
- 1.14.8· Vendor fix available
- Issue
- A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instead of treating Vary as a response-only header. Because Vary tells downstream caches and proxies how to key their cached responses, this allowed a client to inject arbitrary values into the response's Vary header, potentially distorting cache-key behavior in shared caches/CDNs sitting in front of an oRPC server and leading to inconsistent CORS enforcement for other clients. Practical impact is limited to deployments where a shared cache or reverse proxy keys on the Vary header; the real-world effect depends on the caching layer's configuration. Impact May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on Vary. No direct…
Recommended action: Upgrade to 1.14.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.