Executive brief
tRPC is a popular TypeScript framework for building remote procedure call APIs. A vulnerability in its WebSocket server allows any unauthenticated user to crash the entire application by sending a single malformed message during connection setup. This results in immediate service unavailability and potential data loss, affecting all users and operations relying on the API.
Technical details
The vulnerability exists in tRPC's WebSocket connection parameter validation logic introduced in version 11.0.0. When a client sends invalid connectionParams during WebSocket setup, the parseConnectionParams function throws a TRPCError. While this error is caught and handled by the opts.onError handler (which logs and closes the connection), the handler then rethrows the same exception. Since the rethrown error is triggered from within a WebSocket message event handler with no outer exception handling, it becomes an uncaught exception that terminates the entire Node.js process. An unauthenticated attacker can exploit this by sending a single WebSocket message with malformed connectionParams, crashing any tRPC 11 server that has WebSocket enabled and a createContext method configured. The fix, released in version 11.1.1, removes the erroneous rethrow statement so errors are handled without crashing the process.
Affected products
- tRPC @trpc/server 11.0.0 to 11.1.0
Timeline
- 2025-04-24: disclosed
- 2025-04-24: patched: Fixed in version 11.1.1