{"id":"EUVD-2025-203822","enisaUuid":"84a1b8b2-b2cc-367d-8d19-2d3800913aa6","description":"tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`\u0027s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.","datePublished":"Dec 16, 2025, 4:50:42 PM","dateUpdated":"Dec 16, 2025, 9:38:37 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","references":"https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j\n","aliases":"CVE-2025-68130\nGHSA-43p4-m455-4f4j\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"12ed1210-a2d0-3c33-8afd-497fe7176dc0","product":{"name":"trpc","vendor":{"name":"trpc"}},"product_version":"11.0.0, \u003c 11.8.0"},{"id":"4d76f566-f361-35f1-a91e-634cd8a2033f","product":{"name":"trpc","vendor":{"name":"trpc"}},"product_version":"10.27.0, \u003c 10.45.3"}],"enisaIdVendor":[{"id":"8170aaff-790e-3863-b5fa-e1f6559fd945","vendor":{"name":"trpc"}}],"enisaIdVulnerability":[{"id":"20009c39-1989-3a04-bd9c-ab314faa8ce2","vulnerability":{"id":"GHSA-43p4-m455-4f4j","description":"tRPC has possible prototype pollution in `experimental_nextAppDirCaller`","datePublished":"Dec 16, 2025, 7:37:57 PM","dateUpdated":"Dec 16, 2025, 7:37:57 PM","baseScore":0.0,"references":"https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68130\nhttps://github.com/trpc/trpc/commit/78629d524968ef8db5a7adf68d8b95a44369d77e\nhttps://github.com/trpc/trpc\n","enisa_id":"EUVD-2025-203822\n","aliases":"GHSA-43p4-m455-4f4j\nCVE-2025-68130\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"3088ca23-5056-3c54-b4f0-e59131e6dd7e","vulnerability":{"id":"CVE-2025-68130","description":"tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`\u0027s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.","datePublished":"Dec 16, 2025, 4:50:42 PM","dateUpdated":"Dec 16, 2025, 9:38:37 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","references":"https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j\n","enisa_id":"EUVD-2025-203822\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Oct 27, 2026, 7:13:41 AM","vulnerabilityProduct":[{"id":"a6f6f7a5-0126-30df-aea3-6913745be9aa","product":{"name":"trpc","vendor":{"name":"trpc"}},"product_version":"10.27.0, \u003c 10.45.3"},{"id":"ff0ada78-4e34-392b-9359-2e7f41ed10b2","product":{"name":"trpc","vendor":{"name":"trpc"}},"product_version":"11.0.0, \u003c 11.8.0"}],"vulnerabilityVendor":[{"id":"708d52a5-68cd-328f-ad48-c594807226cb","vendor":{"name":"trpc"}}]}}],"enisaIdAdvisory":[]}