tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Description

Note that this vulnerability is only present when using experimental_caller / experimental_nextAppDirCaller.

Recommendation

Update the @trpc/server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0, < 11.8.0

  >= 10.27.0, < 10.45.3**

• Patched version(s): **11.8.0

  10.45.3**

References

• GHSA-43p4-m455-4f4j
• CVE-2025-68130
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• x402 SDK vulnerable in outdated versions in resource servers for builders - Vulnerability
• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) 9 - Vulnerability
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) 8 - Vulnerability

Tags:

npm

@trpc/server