CVE-2025-43855: tRPC 11 WebSocket DoS Vulnerability
Summary
CVE-2025-43855: tRPC 11 WebSocket DoS Vulnerability. Affects @trpc/server versions >= 11.0.0, < 11.1.1. Fixed in 11.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tRPC is a framework for building end-to-end typesafe APIs using TypeScript. It enables developers to create APIs with minimal boilerplate, allowing for seamless communication between client and server. The framework supports various transport layers, including WebSockets, which facilitate real-time communication. However, a vulnerability exists in tRPC 11 when WebSocket connections are enabled, specifically related to the handling of connection parameters.
Vulnerability Detail
An unhandled error occurs when validating invalid connectionParams, which can crash a tRPC WebSocket server. This vulnerability allows any unauthenticated user to send malformed connection parameters, triggering an uncaught exception that results in the server crashing. The issue arises from the connectionParams validation logic introduced in a recent update, which does not adequately handle unexpected input, leading to potential denial-of-service attacks against tRPC 11 servers.
How To Fix
Latest published version: 11.19.0 as of 23 Oct 2026
npm install @trpc/server@11.19.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.1.1
This is the first release that contains the fix.
npm install @trpc/server@11.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on the server-side to ensure that connectionParams are in the expected format before processing them. However, the best solution is to update to the patched version of the package.
Conclusion
The tRPC 11 WebSocket DoS vulnerability (CVE-2025-43855) poses a significant risk to applications using this framework with WebSocket enabled. It is crucial to update to the patched version to ensure the security and stability of your server. Implementing additional validation can serve as a temporary workaround, but updating is the most effective solution.
See every vulnerability recorded for @trpc/server →
FAQ
The vulnerability allows attackers to crash the tRPC WebSocket server, leading to denial of service for legitimate users.
You can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert provides real-time alerts for open-source vulnerabilities.
While the best solution is to update to the patched version, you can implement additional validation for connectionParams as a temporary measure.
The vulnerability affects tRPC version 11.0.0. It is recommended to upgrade to version 11.1.1 or later.
Detailed information about the vulnerability can be found in the official GitHub advisory and the provided links in the vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for @trpc/server.
