CVE-2025-68130
NoneCVSS
—
EPSS
0.4%
Published
Dec 16, 2025
CISA due date
—
The record
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @trpc/server | 10.27.0 | 10.45.3 |
| npm | @trpc/server | 11.0.0 | 11.8.0 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r3 |
| Chainguard | langfuse-2-compat | 0 | 2.95.12-r3 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r3 |
| Chainguard | langfuse-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-3-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-2-compat | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-3-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.141.0-r0 |
| Chainguard | langfuse-web-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-web-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-worker-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3-compat | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.141.0-r0 |
| Wolfi | langfuse-web-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-web-compat | 0 | 3.141.0-r0 |
| Wolfi | langfuse-worker-3 | 0 | 3.141.0-r0 |
Related vulnerabilities
- GHSA-43p4-m455-4f4j tRPC has possible prototype pollution in `experimental_nextAppDirCaller` Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects langfuse-2
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects langfuse-2
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects langfuse-2
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects langfuse-2
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2
- CVE-2026-33672 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2