Log in Start free

Vulnerability · Published Dec 16, 2025 · Assigned by GitHub_M

CVE-2025-68130tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

High 8.5

In plain English

A high-severity prototype pollution in trpc from trpc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.4%top 65.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@trpc/server10.45.3GHSA-43p4-m455-4f4j
npm@trpc/server11.8.0GHSA-43p4-m455-4f4j

Affected products (as reported)

VendorProductVersions
trpc trpc >= 10.27.0, < 10.45.3>= 11.0.0, < 11.8.0

Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

References