CVE-2026-28794 is a critical (CVSS 9.8) prototype pollution flaw in the @orpc/client package before version 1.13.6. Its RPC JSON deserializer lets unauthenticated remote attackers add properties to Object.prototype for the life of the Node.js process. The fix is 1.13.6.
What's affected
The GitHub advisory lists the npm package @orpc/client at 1.13.5 and earlier. The patched version is 1.13.6.
The advisory says the issue affects all server adapters that use the RPC protocol, since the deserializer is shared.
How to check if you're exposed
Check each project for the package, including transitive installs:
npm ls @orpc/client
For pnpm use pnpm why @orpc/client. A result at 1.13.5 or below needs the update. You can also drop a lockfile into the free in-browser dependency scan.
What to do now
- Upgrade
@orpc/clientto 1.13.6 or later and refresh the lockfile. - Rebuild and redeploy every service that uses the RPC adapters. Restart is required, since pollution lives in process memory.
- Keep other oRPC packages aligned with the same release line.
- Add request size and shape limits at the edge as defense in depth.
- Review application behavior for unexplained changes in objects or permissions if you ran an old version while exposed.
Why it matters
The weakness is prototype pollution, CWE-1321. In JavaScript, nearly every object inherits from Object.prototype, so a property added there shows up on objects the code never touched. The advisory says the deserializer did not validate dangerous keys such as __proto__ and constructor when walking attacker-controlled path segments.
Two details raise the risk. The pollution persists for the life of the Node.js process, so one bad request can affect later requests from other users. And the advisory says deserialization runs before schema validation, so a request that is later rejected can still have done the damage.
Impacts the advisory lists are authentication bypass, denial of service and, possibly, remote code execution, depending on what the application does with polluted values. The record does not mark the CVE as exploited in the wild.
If your code builds objects from untrusted paths, the same lesson applies: block those key names or use maps without prototypes.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a rejected request still matter?
Because the advisory says deserialization happens at the start of request handling, before schema validation. The harmful write can happen even if validation fails later.
Sources
Last reviewed: 19 October 2026.
