Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@trpc/server

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
11.25.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release
11.25.0 (Nov 6, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
7.9M
Dependents
575
Releases
500+ since 10.45.3 (Dec 14, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-68130
    Affects 11.0.0 to 11.7.3-canary.6 (11.8.0 is outside it)
  • CVE-2025-43855
    Affects 11.0.0 to 11.1.1-canary.8 (11.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

    Affected: from 10.27.0, fixed in 10.45.3; from 11.0.0, fixed in 11.8.0.

    Fixed in 10.45.3 (released Dec 14, 2025, 2 days before disclosure) and 11.8.0 (released Dec 13, 2025, 3 days before disclosure).

    The latest release, 11.25.0, is not affected.

    13% of @trpc/server downloads last week were affected versions (1.1M).

  • tRPC 11 WebSocket DoS Vulnerability

    Affected: from 11.0.0, fixed in 11.1.1.

    Fixed in 11.1.1 (released Apr 22, 2025, 2 days before disclosure).

    The latest release, 11.25.0, is not affected.

    0.5% of @trpc/server downloads last week were affected versions (41.9K).