---
id: CVE-2025-68130
title: >-
  tRPC allows users to build and consume fully typesafe APIs without schemas or
  code generation
summary: >-
  tRPC allows users to build and consume fully typesafe APIs without schemas or
  code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and
  11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s
  `formDa…
severity: none
cwe:
  - CWE-1321
published: '2025-12-16'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68130'
references:
  - url: 'https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00397
epssPercentile: 0.31904
ingestedAt: '2026-10-13T11:23:51.111Z'
---

## Overview

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.