{"schemaVersion":3,"id":"CVE-2025-68130","aliases":["CGA-2vcf-879m-7c6v","CGA-4ppr-4xgf-wfp4","CGA-5crc-6qhr-53c2","CGA-7cmh-m934-2ccw","CGA-8c36-6xjp-v3f2","CGA-8grq-x5rg-f9vc","GHSA-43p4-m455-4f4j","CGA-6cj8-q4w3-86xf","CGA-72vj-3jpv-p357","CGA-8hvq-grw8-f99c","CGA-8j58-hh5x-3928","CGA-98vm-hf5m-5jgf","CGA-cg6c-3hc5-mh69","CGA-chc7-3r8j-3m3j","CGA-cwcp-rvhc-pc4c","CGA-grr8-v3h3-5w7j","CGA-hh2h-jfx7-4fhr","CGA-jmc7-c84q-7xcg","CGA-jqpc-c9cm-fqr3","CGA-pc7p-ch6f-vj3v","CGA-px7c-28cg-5ggr","CGA-qr4w-h5q5-4r9g","CGA-wv4w-qmfv-w95f"],"status":"published","duplicateOf":null,"title":null,"description":"tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, which is used by the Next.js App Router adapter. An attacker can pollute `Object.prototype` by submitting specially crafted FormData field names, potentially leading to authorization bypass, denial of service, or other security impacts. Note that this vulnerability is only present when using `experimental_caller` / `experimental_nextAppDirCaller`. Versions 10.45.3 and 11.8.0 fix the issue.","dates":{"published":"2025-12-16T16:50:42.542Z","modified":"2025-12-16T21:38:37.366Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.5,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00397,"percentile":0.32656,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00397},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00397,"percentile":0.32656}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00397,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00397,"percentile":0.32656}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"langfuse-2","name":"langfuse-2","label":"langfuse-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-compat","name":"langfuse-2-compat","label":"langfuse-2-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-compat","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2","name":"langfuse-fips-2","label":"langfuse-fips-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-compat","name":"langfuse-fips-2-compat","label":"langfuse-fips-2-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-compat","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-compat","name":"langfuse-fips-3-compat","label":"langfuse-fips-3-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-compat","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.141.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.141.0-r0","eol":null,"hubHref":null},{"vendor":"@trpc","product":"server","name":"@trpc/server","label":"server","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@trpc/server","purlType":"npm","versions":[{"text":"≥ 10.27.0, < 10.45.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.0.0, < 11.8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.27.0, < 10.45.3 | ≥ 11.0.0, < 11.8.0","eol":null,"hubHref":null},{"vendor":"trpc","product":"trpc","name":"trpc","label":"trpc","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 10.27.0, < 10.45.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.0.0, < 11.8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.27.0, < 10.45.3 | ≥ 11.0.0, < 11.8.0","eol":null,"hubHref":"/vendor/trpc/trpc"}],"affectedCount":17,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j","label":"github.com/trpc/trpc/security/advisories/GHSA-43p4-m455-4f4j","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68130.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68130.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68130","label":"nvd.nist.gov/vuln/detail/CVE-2025-68130","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/trpc/trpc/commit/78629d524968ef8db5a7adf68d8b95a44369d77e","label":"github.com/trpc/trpc/commit/78629d524968ef8db5a7adf68d8b95a44369d77e","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/trpc/trpc","label":"github.com/trpc/trpc","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-349C-9R8J-9CFR","CGA-CQXJ-CVQG-WG43","CGA-GM6F-CX62-2FGG","CGA-J79X-4H8M-4MM8","CGA-XWG9-HJVH-VWQH"]},"timeline":[{"kind":"published","date":"2025-12-16T16:50:42.542Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-12-16T21:38:37.366Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:19:27.484Z","stale":false,"partial":false}}