PT-2025-17733 · Trpc · Trpc

Lukechilds · Published 2025-04-24 · Updated 2025-04-24 · CVE-2025-43855

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tRPC versions 11.0.0 through 11.1.0

Description The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocket enabled and a createContext method set.

Recommendations For versions 11.0.0 through 11.1.0, update to version 11.1.1 to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-460

CWE-248

Related Identifiers

CVE-2025-43855

GHSA-PJ3V-9CM8-GVJ8

Affected Products

Trpc

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43855.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-43855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43855 · Security Note
• https://osv.dev/vulnerability/GHSA-pj3v-9cm8-gvj8 · Vendor Advisory
• https://github.com/trpc/trpc · Note
• https://github.com/trpc/trpc/commit/9beb26c636d44852e0f407f3d7a82ad54df65b4d · Note
• https://github.com/trpc/trpc/security/advisories/GHSA-pj3v-9cm8-gvj8 · Note
• https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/adapters/ws.ts#L171 · Note
• https://github.com/trpc/trpc/pull/5839 · Note
• https://t.me/cvedetector/23671 · Telegram Post
• https://twitter.com/CVEnew/status/1915408963937468632 · Twitter Post