CVE-2026-28794: `@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

March 2, 2026 (updated March 6, 2026)

A critical Prototype Pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution.

References

github.com/advisories/GHSA-m272-9rp6-32mc
github.com/middleapi/orpc
github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5
github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc
nvd.nist.gov/vuln/detail/CVE-2026-28794

Code Behaviors & Features

Detect and mitigate CVE-2026-28794 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →