Medium, CVSS 6.5npmAmendedPublished
@orpc/zod: Prototype injection in smart coercion
CVE-2026-103918 · GHSA-gcgf-fh7c-8gf2
- Affected
- npm @orpc/zod < 1.14.10
- Fixed in
- 1.14.10· Vendor fix available
- Issue
- ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of the coerced input object, and 2. make a request fail with an unhandled TypeError by sending a key such as constructor. This is the same class of bug as GHSA-4h5r-cv8j-4456 in @orpc/json-schema, in a different package. This is not global prototype pollution The global Object.prototype is never modified. No shared or global state is written, so other objects in the process, other requests, and other users are not affected. What changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary {} created anywhere else in the…
Recommended action: Upgrade to 1.14.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.