Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
middleapi orpc
< 1.14.8affected
References
- https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f ↗
- https://github.com/middleapi/orpc/issues/1661 ↗
- https://github.com/middleapi/orpc/pull/1662 ↗
- https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f ↗
- https://github.com/middleapi/orpc/releases/tag/v1.14.8 ↗