Executive brief
tRPC is a TypeScript RPC framework used to build type-safe APIs. The formDataToObject function in its Next.js App Router adapter fails to sanitize form field names, allowing an attacker to inject properties into JavaScript's Object.prototype. This can lead to authorization bypass (gaining admin access without credentials), denial of service, or other runtime failures depending on how the application checks permissions.
Technical details
The vulnerability is a classic prototype pollution flaw in the set() function within formDataToObject.ts. The function recursively parses FormData field names containing bracket/dot notation (e.g., user[name], user.address.city) to create nested objects but does not validate or reject dangerous keys like __proto__, constructor, or prototype. When processing a FormData entry with key __proto__[isAdmin], the function splits it into parts, accesses Object.prototype via obj["__proto__"], and assigns properties to it. An attacker can craft FormData with malicious field names and submit it to a tRPC mutation using Next.js Server Actions. The vulnerability is only present when using experimental_nextAppDirCaller and normalizeFormData is enabled. Impact ranges from authorization bypass (if the application checks user.isAdmin) to denial of service (if commonly used methods like toString are polluted). Patches are available in @trpc/server 10.45.3 and 11.8.0.
Affected products
- tRPC @trpc/server >=10.27.0, <10.45.3; >=11.0.0, <11.8.0
Timeline
- 2025-12-15: disclosed: Vulnerability published on GitHub Advisory
- 2025-12-16: patched: Patches released in @trpc/server 10.45.3 and 11.8.0