Read the docs
TI-2025-41711 Aliases CVE-2025-68130GHSA-43p4-m455-4f4j

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Priority HIGH 76CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed trpc (trpc): 10.45.3, 11.8.0@trpc/server (npm): 10.45.3, 11.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
trpctrpc10.27.0 to before 10.45.3; 11.0.0 to before 11.8.010.45.3, 11.8.0Patch availableCNA
—@trpc/server (npm)10.27.0 to before 10.45.310.45.3Patch availableGHSA-43p4-m455-4f4j
—@trpc/server (npm)11.0.0 to before 11.8.011.8.0Patch availableGHSA-43p4-m455-4f4j
  • trpc Vendortrpc Affected 10.27.0 to before 10.45.3; 11.0.0 to before 11.8.0 Fixed in 10.45.3, 11.8.0 Patch available CNA
  • @trpc/server (npm) Vendor— Affected 10.27.0 to before 10.45.3 Fixed in 10.45.3 Patch available GHSA-43p4-m455-4f4j
  • @trpc/server (npm) Vendor— Affected 11.0.0 to before 11.8.0 Fixed in 11.8.0 Patch available GHSA-43p4-m455-4f4j

Remediation

  • Fix · CNA trpc (trpc) Fixed in 10.45.3, 11.8.0
  • Fix · GHSA-43p4-m455-4f4j @trpc/server (npm) Fixed in 10.45.3 Advisory →
  • Fix · GHSA-43p4-m455-4f4j @trpc/server (npm) Fixed in 11.8.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68130
  2. 2026-10-03 Alias added: GHSA-43p4-m455-4f4j

References

Advisory 1

Other 3

  • TI-2025-28439 tRPC 11 WebSocket DoS Vulnerability CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences