CVE-2025-43855 HIGH

CVE-2025-43855: tRPC 11 WebSocket DoS Vulnerability

Vendor Trpc

Product trpc

Weakness CWE-248

Published April 24, 2025

Last update May 14, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.

Key dates

02Disclosure timeline

April 24, 2025 CVE published

May 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-43855 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/248.html

Related vulnerabilities

04Related CVE

CVE-2026-27631 Exiv2: Uncaught exception - cannot create std::vector larger than max_size() CVE-2025-8870 On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device. CVE-2026-31949 LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos CVE-2026-7183 aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception CVE-2026-46411 FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older