CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317

Nango before version 0.71.6 contains a missing authentication vulnerability in the runner tRPC server . The exposed start procedure does not enforce the RUNNER_SECRET_KEY environment variable, allowing an unauthenticated attacker with network access to the runner port to invoke it and achieve rem...

EUVD-2026-71631

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Note that this vulnerability is only present when using experimentalcaller / experimentalnextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...

GHSA-43P4-M455-4F4J tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Note that this vulnerability is only present when using experimentalcaller / experimentalnextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...

@0x/swap-ts-sdk (>=2.0.0, <=2.2.0-beta.1), @airbase/airbase-cli (>=2.0.0-alpha.7, <=3.0.0-beta.15) +53 more potentially affected by CVE-2025-68130 via @trpc/server (>=10.27.1, <=10.45.2)

@trpc/server NPM version =10.27.1, =2.0.0, =2.0.0-alpha.7, =2.18.0, =1.0.0, =0.2.0, =0.1.9, =0.1.0, =0.9.0-dev.1, =0.5.0-rc.5, =0.0.2, =0.0.1, =0.3.1 - @jvl/api 1.0.0 and more Source cves: CVE-2025-68130 Source advisory: SNYK:JS-TRPCSERVER-14427432...

@arken/evolution-protocol (>=2.0.2, <=2.0.14), @arken/forge-protocol (>=0.1.0, <=0.1.6) +129 more potentially affected by CVE-2025-68130 via @trpc/server (>=11.0.0-next-beta.193, <=11.7.2)

@trpc/server NPM version =11.0.0-next-beta.193, =2.0.2, =0.1.0, =1.5.0, =0.1.1, =0.1.0, =0.0.1-alpha.9, =2.0.9-beta.1, =2.0.9-beta.1, =0.0.1-rc.7, =0.13.1-rc.25, =0.0.1-rc.2, =0.1.0, =1.8.1-rc.6747688, =0.1.0, =0.4.0 - @elwood/react 0.4.0 and more Source cves: CVE-2025-68130 Source advisory:...

Prototype Pollution

Overview @trpc/server is a The tRPC server library Affected versions of this package are vulnerable to Prototype Pollution via the formDataToObject function. An attacker can modify Object.prototype by submitting specially crafted FormData field names, which may result in authorization bypass,...

EUVD-2025-203822

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...

PT-2025-51757

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...

Denial Of Service (DoS)

@trpc/server is vulnerable to Denial Of Service DoS. The vulnerability is due to improper input validation due in unhandled error when validating malformed connectionParams in WebSocket connections, allowing unauthenticated users to crash the server...

@arken/evolution-protocol (>=2.0.2, <=2.0.14), @arken/forge-protocol (>=0.1.0, <=0.1.6) +60 more potentially affected by CVE-2025-43855 via @trpc/server (>=11.0.0-next-beta.193, <=11.1.0)

@trpc/server NPM version =11.0.0-next-beta.193, =2.0.2, =0.1.0, =1.5.0, =0.1.1, =0.1.0, =0.0.1-alpha.9, =0.0.1-rc.7, =0.13.1-rc.25, =0.0.1-rc.2, =0.1.0, =0.1.0, =0.0.226, =0.1.0-alpha.0, =0.1.0-alpha.3 and more Source cves: CVE-2025-43855 Source advisory: OSV:GHSA-PJ3V-9CM8-GVJ8...