Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/%40trpc/server@11.8.0
purl pkg:npm/%40trpc/server@11.8.0
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-pe4s-4ax8-ufab tRPC has possible prototype pollution in `experimental_nextAppDirCaller` A Prototype Pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. CVE-2025-68130
GHSA-43p4-m455-4f4j

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:54:13.053482+00:00 GHSA Importer Fixing VCID-pe4s-4ax8-ufab https://github.com/advisories/GHSA-43p4-m455-4f4j 38.6.0
2026-06-04T17:10:00.636624+00:00 GithubOSV Importer Fixing VCID-pe4s-4ax8-ufab https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-43p4-m455-4f4j/GHSA-43p4-m455-4f4j.json 38.6.0
2026-06-02T04:49:13.544644+00:00 GitLab Importer Fixing VCID-pe4s-4ax8-ufab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@trpc/server/CVE-2025-68130.yml 38.6.0