GHSA-j9v4-rhgr-4m5f: Npm/@orpc/server vulnerability

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server.

Details The CORS plugin previously copied the request's Vary header directly onto the response instead of treating Vary as a response-only header. Because Vary tells downstream caches and proxies how to key their cached responses, this allowed a client to inject arbitrary values into the response's Vary header, potentially distorting cache-key behavior in shared caches/CDNs sitting in front of an oRPC server and leading to inconsistent CORS enforcement for other clients.

Practical impact is limited to deployments where a shared cache or reverse proxy keys on the Vary header; the real-world effect depends on the caching layer's configuration.

Impact May cause cache key pollution and inconsistent CORS enforcement in setups that rely on shared/edge caches keying on Vary. No direct confidentiality, integrity, or availability impact in default (non-cached) configurations.

Resolution Update @orpc/server (and any other @orpc/ packages bundling the CORS plugin) to 1.14.8. The CORS plugin now derives Vary exclusively from the response, appending Origin and preserving existing values instead of reflecting request headers.