tRPC WebSocket Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in tRPC versions 11.0.0 prior to 11.1.1. The issue arises when the server encounters invalid connection parameters, leading to an unhandled error that crashes the WebSocket server. This vulnerability allows any unauthenticated user to disrupt a tRPC WebSocket server. The problem occurs on any tRPC 11 server with WebSocket enabled and a context creation method defined.

Impact

Exploitation of this vulnerability causes the tRPC WebSocket server to crash, terminating the server process.

Reproduction

The vulnerability can be reproduced by sending an invalid connection parameter object to a tRPC WebSocket server that is running version 11.0.0 prior to 11.1.1, with WebSocket support enabled and a context creation method specified. This can be done using a WebSocket client that connects to the server and transmits the malformed connection parameters.

Remediation

Users can upgrade to tRPC version 11.1.1 or later to address this vulnerability.