CVE-2025-68130: Prototype Pollution Vulnerability in @trpc/server's formDataToObject Function
Summary
CVE-2025-68130: tRPC has possible prototype pollution in experimental_nextAppDirCaller. Affects @trpc/server across 2 version ranges.
>= 10.27.0, < 10.45.3
>= 11.0.0, < 11.8.0
Fixed in 10.45.3 or 11.8.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @trpc/server package is a TypeScript library designed for building type-safe APIs using tRPC. It facilitates communication between clients and servers with a focus on type safety and developer experience. The package includes various utilities, one of which is the formDataToObject function, used in conjunction with Next.js App Router. This function is vulnerable to prototype pollution, which can lead to severe security implications.
Vulnerability Detail
A Prototype Pollution vulnerability exists in the formDataToObject function of the @trpc/server package. This vulnerability arises when the function processes FormData field names without validating or sanitizing potentially dangerous keys like proto, constructor, or prototype. An attacker can exploit this by submitting specially crafted FormData, allowing them to modify Object.prototype. This can lead to authorization bypass, denial of service, or other security impacts, as all objects will inherit the polluted properties.
How To Fix
Latest published version: 11.19.0 as of 23 Oct 2026
npm install @trpc/server@11.19.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.27.0, < 10.45.310.45.3npm install @trpc/server@10.45.3 -
>= 11.0.0, < 11.8.011.8.0npm install @trpc/server@11.8.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the experimental_caller or experimental_nextAppDirCaller features of the @trpc/server package until you can update to a patched version. Additionally, ensure that any FormData submitted does not include keys that could lead to prototype pollution.
Conclusion
The @trpc/server package has a significant prototype pollution vulnerability that can lead to serious security issues. It is crucial to update to the latest patched versions to mitigate these risks. Additionally, using tools like Vulert can help monitor for vulnerabilities in your application.
See every vulnerability recorded for @trpc/server →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications.
This vulnerability can lead to unauthorized access, denial of service, or other security issues by allowing attackers to manipulate properties on all objects.
Affected versions are >=10.27.0. It is recommended to upgrade to version 10.45.3 or later for the 10.x series, or to version 11.8.0 or later for the 11.x series.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check your application without needing to sign up.
If you cannot update the package immediately, avoid using the vulnerable features and ensure that any FormData submitted does not include potentially dangerous keys.
References
Related vulnerabilities
Recent vulnerabilities recorded for @trpc/server.
