tRPC 11 WebSocket DoS Vulnerability

Description

An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server.

Recommendation

Update the @trpc/server package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.0.0, < 11.1.1
• Patched version(s): 11.1.1

References

• GHSA-pj3v-9cm8-gvj8
• CVE-2025-43855
• CWE-248
• CWE-460
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @rpldy/uploader prototype pollution - CVE-2024-57082
• Signature Malleabillity in elliptic - CVE-2020-13822
• Joplin Vulnerable to Code Injection - CVE-2022-23340
• Prototype pollution in emit function - Vulnerability

Tags:

npm

@trpc/server