CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability
Unauthenticated attackers can crash tRPC WebSocket servers by sending invalid connection parameters, requiring WebSocket and createContext configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-43855?
CVE-2025-43855 is a high-severity denial of service vulnerability in trpc, published on 24 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.
Weakness: CWE-248
Which versions are affected by CVE-2025-43855?
2 open source packages ship an affected version, including @trpc/server.
| Package | Affected | Fixed in |
|---|---|---|
@trpc/server npm | From 11.0.0 | 11.1.1 |
@trpc/server npm | From 11.0.0 | 11.1.1 |
How do I fix CVE-2025-43855?
Upgrade @trpc/server to 11.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-43855 being exploited?
There is no known exploitation of CVE-2025-43855 in the wild and no public exploit code.
Sources
Also known as GHSA-pj3v-9cm8-gvj8.