Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
middleapi/orpc
main @ 94acd87
10
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Denial of Service: 5 prior fixes. Scrutinize any change in this area.
packages/server/src/plugins/cors.ts: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Unsafe dynamic object key assignment when mapping arrays or key-value pairs allows remote attackers to inject properties into Object.prototype, as validated by CVE-2026-28794. This can lead to remote code execution or application-wide denial of service.
Denial of Service: Parsing array bracket-notation keys without verifying size bounds can lead to sparse-to-dense conversions that exhaust system memory rapidly. Strict index checks are required during query parameter deserialization.
CSRF: The RPC handler previously allowed state-mutating actions over GET requests by default, exposing users to basic CSRF attacks. Enforcing a strict GET method plugin and mandatory CSRF token validation ensures safe mutations.