GitHub Security Advisories
16 min
GitHub Security Advisories
CVE-2026-103918: @orpc/zod: Prototype injection in smart coercion
## Summary `ZodSmartCoercionPlugin` and `experimental_ZodSmartCoercionPlugin` mishandle object keys that name `Object.prototype` members. Both coerce request input before validation, so any client that can reach a...