@orpc/zod@0.0.0-next.65fbdd2

Affected versions of this package are vulnerable to Prototype Pollution via the zodCoerceInternal function in coercer.ts (Zod 3) and the #coerce method in zod4/coercer.ts (Zod 4), which are used by ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin respectively. Both plugins coerce untrusted input before validation, and two flaws exist: first, coerced properties are collected into a plain {} object, so assigning an attacker-controlled key such as __proto__ triggers the inherited setter on Object.prototype rather than creating an own property; second, schema shape lookups use direct bracket notation (shape[key]) rather than Object.hasOwn, allowing keys like constructor or toString to resolve to Object.prototype members, which causes a thrown TypeError that breaks coercion for any request containing such keys. An attacker can send an object with a __proto__ key to pollute the prototype of the resulting object, or send a key such as constructor to crash the coercion step entirely.

Upgrade @orpc/zod to version 1.14.10 or higher.