tRPC 11 WebSocket DoS Vulnerability

Description

An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server.

Recommendation

Update the @trpc/server package to the latest compatible version. Followings are version details:

Affected version(s): >= 11.0.0, < 11.1.1
Patched version(s): 11.1.1

References

GHSA-pj3v-9cm8-gvj8
CVE-2025-43855
CWE-248
CWE-460
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for tRPC 11 WebSocket DoS Vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

tRPC has possible prototype pollution in `experimental_nextAppDirCaller` - CVE-2025-68130
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
Finance.js vulnerable to DoS via the seekZero() parameter - CVE-2025-56572

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated April 24, 2025