Prototype Pollution Vulnerability in tRPC's Next.js App Router Adapter
CVE-2025-68130

8.5HIGH

Key Information:

Vendor

Trpc

Status
Trpc
Vendor
CVE Published:
16 December 2025

What is CVE-2025-68130?

A prototype pollution vulnerability was discovered in the formDataToObject function of tRPC's @trpc/server, affecting versions up to 10.44.0 and 11.7.0. This issue arises specifically when using the experimental features experimental_caller or experimental_nextAppDirCaller. By exploiting this vulnerability, an attacker can manipulate Object.prototype through specially crafted FormData field names, which may result in critical security issues such as authorization bypass or potential denial of service scenarios. To mitigate this risk, users are advised to upgrade to versions 10.45.3 or 11.8.0, where the vulnerability has been addressed. For more details, refer to the official advisory.

Affected Version(s)

trpc >= 10.27.0, < 10.45.3 < 10.27.0, 10.45.3

trpc >= 11.0.0, < 11.8.0 < 11.0.0, 11.8.0

References

https://github.com/trpc/trpc/security/advisories/GHSA-43p...
x_refsource_CONFIRM

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68130 : Prototype Pollution Vulnerability in tRPC's Next.js App Router Adapter