PT-2025-51757 · Vercel+2 · Next.Js App Router+2

Published 2025-12-16 · Updated 2025-12-16 · CVE-2025-68130

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions tRPC versions 10.27.0 through 10.45.2 tRPC versions 11.0.0 through 11.7.9

Description tRPC enables the creation of fully typesafe APIs without requiring schemas or code generation. A prototype pollution issue exists in the @trpc/server's formDataToObject function, specifically when used with the Next.js App Router adapter. An attacker can manipulate Object.prototype by submitting specially crafted FormData field names. This could potentially lead to authorization bypass or denial of service. The issue is only present when using experimental caller / experimental nextAppDirCaller.

Recommendations Update to tRPC version 10.45.3 or later. Update to tRPC version 11.8.0 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-68130

GHSA-43P4-M455-4F4J

Affected Products

@Trpc/Server

Next.Js App Router

Trpc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68130.json · Exploit
• https://osv.dev/vulnerability/GHSA-43p4-m455-4f4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68130 · Security Note
• https://github.com/trpc/trpc/commit/78629d524968ef8db5a7adf68d8b95a44369d77e · Note
• https://github.com/trpc/trpc · Note
• https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j · Note
• https://twitter.com/CVEnew/status/2000986383259984163 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001052941801627945 · Twitter Post