https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T18:53:49.508807+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-239367 EUVD-2026-239367 2026-10-08T18:53:49.510867+00:00 EUVD-2026-239367 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43855 fkie_cve-2025-43855 2026-10-08T18:53:49.510899+00:00

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-pj3v-9cm8-gvj8 GHSA-pj3v-9cm8-gvj8 — tRPC 11 WebSocket DoS Vulnerability 2026-10-08T18:53:49.510932+00:00

Affected: npm: @trpc/server

### Summary

An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server.

### Details Any tRPC 11 server with WebSocket enabled with a `createContext` method set is vulnerable. Here is an example:

https://github.com/user-attachments/assets/ce1b2d32-6103-4e54-8446-51535b293b05

I have a working reproduction here if you would like to test: https://github.com/lukechilds/trpc-vuln-reproduction

The connectionParams logic introduced in https://github.com/trpc/trpc/pull/5839 does not safely handle invalid connectionParams objects. During validation if the object does not match an expected shape an error will be thrown:

https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/unstable-core-do-not-import/http/parseConnectionParams.ts#L27-L33

This is called during WebSocket connection setup inside `createCtxPromise()` here:

https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/adapters/ws.ts#L435

`createCtxPromise` has handling to catch any errors and pass them up to the `opts.onError` handler:

https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/adapters/ws.ts#L144-L173

However the error handler then rethrows the error:

https://github.com/trpc/trpc/blob/8cef54eaf95d8abc8484fe1d454b6620eeb57f2f/packages/server/src/adapters/ws.ts#L171

S…