tRPC CVE-2025-68130

Exploitation requires the application to use tRPC's experimental experimental_caller / experimental_nextAppDirCaller Next.js App Router adapter with FormData normalization active (the adapter calls formDataToObject(input) when normalizeFormData is set and the input is a FormData instance). The attacker must be able to reach a tRPC mutation exposed as a Next.js Server Action and submit multipart FormData whose field names use bracket/dot notation containing __proto__, constructor, or prototype keys. Limiting factors: this is NOT a default tRPC configuration (the adapter is explicitly experimental), the vulnerable code path exists only in @trpc/server versions >=10.27.0,<10.45.3 and >=11.0.0,<11.8.0, and the vendor assigns PR:L implying the mutation endpoint is reachable at a low privilege level - though whether that specific Server Action requires authentication is application-dependent. No special user interaction beyond submitting the form is needed.

This is a genuine, prioritizable issue but one that is gated by a specific deployment condition rather than a broadly exposed default. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.5 and reflects network reachability, low complexity, and high integrity impact (VI:H/SI:H) consistent with a prototype-pollution-driven authorization bypass, with secondary availability/DoS (VA:L) and confidentiality (VC:L) effects. Countering that severity, the EPSS score is low (0.40%, 32nd percentile), it is NOT on CISA KEV, and exploitation is confined to applications using the experimental experimental_caller / experimental_nextAppDirCaller Next.js App Router adapter - a narrow, non-default configuration. The GitHub Security Advisory includes a concrete, working proof-of-concept (field names such as __proto__[isAdmin]=true), so publicly available exploit code exists, but POC availability is distinct from active exploitation and there is no evidence of exploitation in the wild. Net: real priority for teams running the affected experimental adapter (patch promptly), but low widespread-exploitation urgency otherwise. One signal to verify: the vendor chose PR:L, implying an authenticated/reachable mutation, yet whether a given Server Action endpoint requires authentication is application-specific - teams whose affected mutation is publicly reachable should treat the privilege requirement as effectively PR:N.

An attacker submits a crafted multipart FormData payload to a Next.js Server Action that is backed by tRPC's experimental nextAppDirCaller, using malicious field names like __proto__[isAdmin]=true or __proto__[role]=superadmin. The vulnerable formDataToObject recursively walks the bracket/dot path without filtering dangerous keys, polluting Object.prototype so that every object in the process inherits attacker-controlled properties, enabling authorization bypass or denial of service. A detailed working proof-of-concept is published in the GitHub Security Advisory.