GHSA-43p4-m455-4f4j
NoneCVSS
—
EPSS
—
Published
Dec 16, 2025
CISA due date
—
The record
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @trpc/server | 10.27.0 | 10.45.3 |
| npm | @trpc/server | 11.0.0 | 11.8.0 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r3 |
| Chainguard | langfuse-2-compat | 0 | 2.95.12-r3 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r3 |
| Chainguard | langfuse-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-3-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-2-compat | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r3 |
| Chainguard | langfuse-fips-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-3-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.141.0-r0 |
| Chainguard | langfuse-web-3 | 0 | 3.141.0-r0 |
| Chainguard | langfuse-web-compat | 0 | 3.141.0-r0 |
| Chainguard | langfuse-worker-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3-compat | 0 | 3.141.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.141.0-r0 |
| Wolfi | langfuse-web-3 | 0 | 3.141.0-r0 |
| Wolfi | langfuse-web-compat | 0 | 3.141.0-r0 |
| Wolfi | langfuse-worker-3 | 0 | 3.141.0-r0 |
Related vulnerabilities
- CVE-2025-68130 tRPC allows users to build and consume fully typesafe APIs without schemas or code… Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects langfuse-2
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects langfuse-2
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects langfuse-2
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects langfuse-2
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2
- CVE-2026-33672 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2