AIKIDO-2026-429504

TL;DR

The CORS plugin in @orpc/server copies the incoming request's Vary header directly onto the response instead of treating Vary as a server-controlled response header. Because a client controls the request Vary value, it can inject arbitrary values that are reflected back into the response Vary, influencing how shared caches and CDNs key cached responses. In deployments fronted by a shared cache or reverse proxy that keys on Vary, this can cause cache-key pollution and inconsistent CORS enforcement across clients. The fix stops copying the request Vary and instead derives the response Vary from server-controlled values, appending Origin only when it is absent.