CVE-2025-43855

Description

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.

Reserved 2025-04-17 | Published 2025-04-24 | Updated 2025-05-14 | Assigner GitHub_M

Problem types

CWE-248: Uncaught Exception

Product status

>= 11.0.0, < 11.1.1
affected

Credits

Luke Childs <mail@lu.ke>

References

github.com/trpc/trpc/security/advisories/GHSA-pj3v-9cm8-gvj8

github.com/...ommit/9beb26c636d44852e0f407f3d7a82ad54df65b4d

cve.org (CVE-2025-43855)

nvd.nist.gov (CVE-2025-43855)

Download JSON