CVE-2026-112043

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

EUVD-2026-104051

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-9317

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

EUVD-2026-71631

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317

Nango before version 0.71.6 contains a missing authentication vulnerability in the runner tRPC server . The exposed start procedure does not enforce the RUNNER_SECRET_KEY environment variable, allowing an unauthenticated attacker with network access to the runner port to invoke it and achieve rem...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

PT-2026-86222

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.71.6 Description The runner tRPC server contains a missing authentication flaw that allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code. This is achieved by...

CVE-2026-9317: Missing Authentication for Critical Function

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

@comenchi/admin (>=2.0.9-beta.1, <=3.0.0-beta.20), @comenchi/shop (>=2.0.9-beta.1, <=3.0.3) +71 more potentially affected by CVE-2025-68130 via @trpc/server (>=11.0.1, <=11.7.2)

@trpc/server NPM version =11.0.1, =2.0.9-beta.1, =2.0.9-beta.1, =1.8.1-rc.6747688, =0.0.1, =1.1.1, =1.1.1, =1.1.1, =9.4.1, =1.1.213, =1.1.1, =1.1.1, =1.1.1, =1.6.1, =0.2.15, =1.1.1, =1.1.29 and more Source cves: CVE-2025-68130 Source advisory: GHSA-43P4-M455-4F4J...

@comenchi/admin (>=2.0.9-beta.1, <=3.0.0-beta.20), @comenchi/shop (>=2.0.9-beta.1, <=3.0.3) +71 more potentially affected by CVE-2025-68130 via @trpc/server (>=11.0.1, <=11.7.2)

@trpc/server NPM version =11.0.1, =2.0.9-beta.1, =2.0.9-beta.1, =1.8.1-rc.6747688, =0.0.1, =1.1.1, =1.1.1, =1.1.1, =9.4.1, =1.1.213, =1.1.1, =1.1.1, =1.1.1, =1.6.1, =0.2.15, =1.1.1, =1.1.29 and more Source cves: CVE-2025-68130 Source advisory: OSV:GHSA-43P4-M455-4F4J...

@0x/swap-ts-sdk (>=2.0.0, <=2.2.0-beta.1), @airbase/airbase-cli (>=2.0.0-alpha.7, <=3.0.0-beta.15) +53 more potentially affected by CVE-2025-68130 via @trpc/server (>=10.27.1, <=10.45.2)

@trpc/server NPM version =10.27.1, =2.0.0, =2.0.0-alpha.7, =2.18.0, =1.0.0, =0.2.0, =0.1.9, =0.1.0, =0.9.0-dev.1, =0.5.0-rc.5, =0.0.2, =0.0.1, =0.3.1 - @jvl/api 1.0.0 and more Source cves: CVE-2025-68130 Source advisory: GHSA-43P4-M455-4F4J...

GHSA-43P4-M455-4F4J tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Note that this vulnerability is only present when using experimentalcaller / experimentalnextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Note that this vulnerability is only present when using experimentalcaller / experimentalnextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...

Prototype Pollution

Overview @trpc/server is a The tRPC server library Affected versions of this package are vulnerable to Prototype Pollution via the formDataToObject function. An attacker can modify Object.prototype by submitting specially crafted FormData field names, which may result in authorization bypass,...

@arken/evolution-protocol (>=2.0.2, <=2.0.14), @arken/forge-protocol (>=0.1.0, <=0.1.6) +110 more potentially affected by CVE-2025-68130 via @trpc/server (>=11.0.0-next.320, <=11.7.2)

@trpc/server NPM version =11.0.0-next.320, =2.0.2, =0.1.0, =1.5.0, =0.1.1, =0.1.0, =2.0.9-beta.1, =2.0.9-beta.1, =0.0.1-rc.7, =0.13.1-rc.25, =0.0.1-rc.2, =0.1.0, =1.8.1-rc.6747688, =0.0.226, =0.1.0-alpha.0, =0.0.0, =0.0.7 and more Source cves: CVE-2025-68130 Source advisory:...

@0x/swap-ts-sdk (>=2.0.0, <=2.2.0-beta.1), @airbase/airbase-cli (>=2.0.0-alpha.7, <=3.0.0-beta.15) +53 more potentially affected by CVE-2025-68130 via @trpc/server (>=10.27.1, <=10.45.2)

@trpc/server NPM version =10.27.1, =2.0.0, =2.0.0-alpha.7, =2.18.0, =1.0.0, =0.2.0, =0.1.9, =0.1.0, =0.9.0-dev.1, =0.5.0-rc.5, =0.0.2, =0.0.1, =0.3.1 - @jvl/api 1.0.0 and more Source cves: CVE-2025-68130 Source advisory: SNYK:JS-TRPCSERVER-14427432...

@comenchi/admin (>=2.0.9-beta.1, <=3.0.0-beta.20), @comenchi/shop (>=2.0.9-beta.1, <=3.0.3) +71 more potentially affected by CVE-2025-68130 via @trpc/server (>=11.0.1, <=11.7.2)

@trpc/server NPM version =11.0.1, =2.0.9-beta.1, =2.0.9-beta.1, =1.8.1-rc.6747688, =0.0.1, =1.1.1, =1.1.1, =1.1.1, =9.4.1, =1.1.213, =1.1.1, =1.1.1, =1.1.1, =1.6.1, =0.2.15, =1.1.1, =1.1.29 and more Source cves: CVE-2025-68130 Source advisory: MEND:CVE-2025-68130...

@0x/swap-ts-sdk (>=2.0.0, <=2.2.0-beta.1), @airbase/airbase-cli (>=2.0.0-alpha.7, <=3.0.0-beta.15) +53 more potentially affected by CVE-2025-68130 via @trpc/server (>=10.27.1, <=10.45.2)

@trpc/server NPM version =10.27.1, =2.0.0, =2.0.0-alpha.7, =2.18.0, =1.0.0, =0.2.0, =0.1.9, =0.1.0, =0.9.0-dev.1, =0.5.0-rc.5, =0.0.2, =0.0.1, =0.3.1 - @jvl/api 1.0.0 and more Source cves: CVE-2025-68130 Source advisory: MEND:CVE-2025-68130...