CVE-2025-68130highCWE-1321

CVE-2025-68130: falha de alta gravidade em trpc

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Publicada em

Seguir esta CVE+ Monitorar trpc+ Monitorar @trpc/server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.4%
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L
Produtos afetados
trpc · trpc
CVEs relacionadas — trpc

No mesmo produto, das mais perigosas para as menos.

CVE-2025-43855HIGHtRPC 11 WebSocket DoS VulnerabilityEPSS 0.4%