trpc @trpc/server vulnerabilities

Latest trpc @trpc/server CVEs

Newest publication first

1. CVE-2025-68130 tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

   Published 2025-12-16

   High·CVSS 8.5

   tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next...

2. CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability

   Published 2025-04-24

   High·CVSS 8.7

   tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthentic...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.