CVE-2025-68130 tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Prototype pollution in tRPC's Next.js adapter allows attackers to bypass authorization or cause denial of service via crafted FormData.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68130?
CVE-2025-68130 is a high-severity vulnerability in trpc, published on 16 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.
Weakness: CWE-1321
Which versions are affected by CVE-2025-68130?
4 open source packages ship an affected version, including @trpc/server.
| Package | Affected | Fixed in |
|---|---|---|
@trpc/server npm | From 10.27.0 | 10.45.3 |
@trpc/server npm | From 10.27.0 | 10.45.3 |
@trpc/server npm | From 11.0.0 | 11.8.0 |
@trpc/server npm | From 11.0.0 | 11.8.0 |
How do I fix CVE-2025-68130?
Upgrade @trpc/server to a fixed version for your release line: 10.45.3 or 11.8.0.
Is CVE-2025-68130 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68130 exists.
Sources
Also known as GHSA-43p4-m455-4f4j.