oRPC is an API toolkit that relies on JSON serialization for RPC calls. Prior to version 1.13.6, the @orpc/client package contained a prototype pollution flaw in its StandardRPCJsonSerializer. An attacker could send a specially crafted JSON payload that would be deserialized into the client’s runtime and inject arbitrary properties into the global Object.prototype. Because the polluted prototype persists for the remainder of the Node.js process, the instance becomes vulnerable to subsequent misuse. This flaw can be leveraged for authentication bypass, denial‑of‑service, and potentially Remote Code Execution, depending on how the polluted properties interact with application logic.

Any Node.js application that imports the @orpc/client library from the middleapi:orpc vendor and runs a version older than 1.13.6 is affected. This includes direct usage in user code, indirect usage through other packages, or any server that processes untrusted RPC requests through the vulnerable serializer.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is listed as less than 1%, suggesting that widespread exploitation is currently unlikely, and it is not present in the CISA KEV catalog. Nevertheless, the attack vector is remote and unauthenticated, and exploitation only requires an attacker to deliver a malicious JSON payload over any channel that the RPC service accepts. Once executed, the injection can persist for the lifetime of the process, making the risk long‑lasting. Administrators should treat this flaw with the same urgency as any remote code execution vulnerability.