tRPC 11 WebSocket DoS Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| trpc | trpc | 11.0.0 to before 11.1.1 | 11.1.1 | Patch available | CNA |
| — | @trpc/server (npm) | 11.0.0 to before 11.1.1 | 11.1.1 | Patch available | GHSA-pj3v-9cm8-gvj8 |
- trpc Vendortrpc Affected 11.0.0 to before 11.1.1 Fixed in 11.1.1 Patch available CNA
- @trpc/server (npm) Vendor— Affected 11.0.0 to before 11.1.1 Fixed in 11.1.1 Patch available GHSA-pj3v-9cm8-gvj8
Remediation
- Fix · CNA trpc (trpc) Fixed in 11.1.1
- Fix · GHSA-pj3v-9cm8-gvj8 @trpc/server (npm) Fixed in 11.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43855
- 2026-10-03 Alias added: GHSA-pj3v-9cm8-gvj8
References
Other 5
- https://github.com/trpc/trpc/security/advisories/GHSA-pj3v-9cm8-gvj8
- https://github.com/trpc/trpc/commit/9beb26c636d44852e0f407f3d7a82ad54df65b4d
- https://github.com/trpc/trpc/pull/5839
- https://github.com/trpc/trpc
- https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/adapters/ws.ts#L171
More trpc vulnerabilities
- TI-2025-41711 tRPC has possible prototype pollution in `experimental_nextAppDirCaller` CVSS 4.0HIGH 8.5
Sources
- CVE-2025-43855 · CVE Program
- CVE-2025-43855 · NVD
- FIRST EPSS
- GHSA-pj3v-9cm8-gvj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences