Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-101916 (GCVE-0-2026-101916)

Vulnerability from nvd – Published: 2026-09-28 20:01 – Updated: 2026-09-28 20:01

Title

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/2a84ec8b…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b4e0079c…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.6 Affected: >= 1.14.0, < 1.14.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:01:53.640Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
        }
      ],
      "source": {
        "advisory": "GHSA-m9gg-hp2v-232j",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101916",
    "datePublished": "2026-09-28T20:01:53.640Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-28T20:01:53.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101915 (GCVE-0-2026-101915)

Vulnerability from nvd – Published: 2026-09-28 19:48 – Updated: 2026-09-28 19:48

Title

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-550 - Server-generated Error Message Containing Sensitive Information

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/350de328…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/7c5c5181…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/e8329b12…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.6 Affected: >= 1.14.0, < 1.14.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-550",
              "description": "CWE-550: Server-generated Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:48:09.860Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
        }
      ],
      "source": {
        "advisory": "GHSA-f596-whhp-79r4",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101915",
    "datePublished": "2026-09-28T19:48:09.860Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-28T19:48:09.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101914 (GCVE-0-2026-101914)

Vulnerability from nvd – Published: 2026-09-28 19:36 – Updated: 2026-09-29 19:21

Title

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 19:21 UTC

CWE

CWE-187 - Partial String Comparison
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/6cf64b59…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/a6c5b311…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/f32f3712…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.1 Affected: >= 1.14.0, < 1.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:21:06.531070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:21:17.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method\u0027s rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-187",
              "description": "CWE-187: Partial String Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:46:53.330Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-88h9-xgvx-hvf2",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101914",
    "datePublished": "2026-09-28T19:36:55.746Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-29T19:21:17.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48069 (GCVE-0-2026-48069)

Vulnerability from nvd – Published: 2026-07-14 19:42 – Updated: 2026-07-15 13:27

Title

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 13:23 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root Scorecard

References

13 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/2375eadc…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/2fe55fd7…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/4091bd90…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b3f16094…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b61c4d65…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b6dcfc3c…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.9.16 Affected: >= 1.10.0, < 1.10.12 Affected: >= 1.11.0, < 1.11.4 Affected: >= 1.12.0, < 1.12.7 Affected: >= 1.13.0, < 1.13.5 Affected: >= 1.14.0, < 1.14.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:23:14.814118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T13:27:06.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.11.0, \u003c 1.11.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:42:32.883Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"
        }
      ],
      "source": {
        "advisory": "GHSA-99f4-grh7-6pcq",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48069",
    "datePublished": "2026-07-14T19:42:32.883Z",
    "dateReserved": "2026-05-20T18:25:25.708Z",
    "dateUpdated": "2026-07-15T13:27:06.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48068 (GCVE-0-2026-48068)

Vulnerability from nvd – Published: 2026-07-14 19:39 – Updated: 2026-07-21 14:56

Title

@grpc/grps-js: A malformed request can cause a server crash

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:56 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root Scorecard

References

13 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/058665a6…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/1cf4bfa7…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/234f9172…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/455efce8…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b1b7268f…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/e2c035aa…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.9.16 Affected: >= 1.11.0, < 1.11.4 Affected: >= 1.12.0, < 1.12.7 Affected: >= 1.13.0, < 1.13.5 Affected: >= 1.14.0, < 1.14.4 Affected: >= 1.10.0, < 1.10.12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:56:42.579603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:56:52.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.11.0, \u003c 1.11.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:39:42.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"
        }
      ],
      "source": {
        "advisory": "GHSA-5375-pq7m-f5r2",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grps-js: A malformed request can cause a server crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48068",
    "datePublished": "2026-07-14T19:39:42.607Z",
    "dateReserved": "2026-05-20T18:25:25.708Z",
    "dateUpdated": "2026-07-21T14:56:52.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-37168 (GCVE-0-2024-37168)

Vulnerability from nvd – Published: 2024-06-10 21:32 – Updated: 2024-08-02 03:50

Title

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-11 14:03 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/08b0422d…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/674f4e35…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/a8a02033…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
grpc	grpc-node	Affected: >= 1.10.0, < 1.10.9 Affected: >= 1.9.0, < 1.9.15 Affected: < 1.8.22
grpc	grpc	Affected: 1.10.0 , < 1.10.9 (custom) Affected: 1.9.0 , < 1.9.15 (custom) Affected: 0 , < 1.8.22 (custom) cpe:2.3:a:grpc:grpc:1.10.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:grpc:grpc:1.10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "grpc",
            "vendor": "grpc",
            "versions": [
              {
                "lessThan": "1.10.9",
                "status": "affected",
                "version": "1.10.0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.9.15",
                "status": "affected",
                "version": "1.9.0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.8.22",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T14:03:13.988919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T14:05:45.075Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:50:55.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.15"
            },
            {
              "status": "affected",
              "version": "\u003c 1.8.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T21:32:06.403Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb"
        }
      ],
      "source": {
        "advisory": "GHSA-7v5v-9h63-cj86",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js can allocate memory for incoming messages well above configured limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-37168",
    "datePublished": "2024-06-10T21:32:06.403Z",
    "dateReserved": "2024-06-03T17:29:38.330Z",
    "dateUpdated": "2024-08-02T03:50:55.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-101916 (GCVE-0-2026-101916)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:01 – Updated: 2026-09-28 20:01

Title

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/2a84ec8b…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b4e0079c…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.6 Affected: >= 1.14.0, < 1.14.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:01:53.640Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
        }
      ],
      "source": {
        "advisory": "GHSA-m9gg-hp2v-232j",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101916",
    "datePublished": "2026-09-28T20:01:53.640Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-28T20:01:53.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101915 (GCVE-0-2026-101915)

Vulnerability from cvelistv5 – Published: 2026-09-28 19:48 – Updated: 2026-09-28 19:48

Title

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-550 - Server-generated Error Message Containing Sensitive Information

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/350de328…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/7c5c5181…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/e8329b12…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.6 Affected: >= 1.14.0, < 1.14.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-550",
              "description": "CWE-550: Server-generated Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:48:09.860Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
        }
      ],
      "source": {
        "advisory": "GHSA-f596-whhp-79r4",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101915",
    "datePublished": "2026-09-28T19:48:09.860Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-28T19:48:09.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101914 (GCVE-0-2026-101914)

Vulnerability from cvelistv5 – Published: 2026-09-28 19:36 – Updated: 2026-09-29 19:21

Title

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Summary

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 19:21 UTC

CWE

CWE-187 - Partial String Comparison
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/6cf64b59…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/a6c5b311…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/f32f3712…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.13.1 Affected: >= 1.14.0, < 1.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:21:06.531070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:21:17.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method\u0027s rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-187",
              "description": "CWE-187: Partial String Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:46:53.330Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-88h9-xgvx-hvf2",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101914",
    "datePublished": "2026-09-28T19:36:55.746Z",
    "dateReserved": "2026-09-28T15:55:37.907Z",
    "dateUpdated": "2026-09-29T19:21:17.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48069 (GCVE-0-2026-48069)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:42 – Updated: 2026-07-15 13:27

Title

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 13:23 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root Scorecard

References

13 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/2375eadc…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/2fe55fd7…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/4091bd90…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b3f16094…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b61c4d65…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b6dcfc3c…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.9.16 Affected: >= 1.10.0, < 1.10.12 Affected: >= 1.11.0, < 1.11.4 Affected: >= 1.12.0, < 1.12.7 Affected: >= 1.13.0, < 1.13.5 Affected: >= 1.14.0, < 1.14.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:23:14.814118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T13:27:06.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.11.0, \u003c 1.11.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:42:32.883Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"
        }
      ],
      "source": {
        "advisory": "GHSA-99f4-grh7-6pcq",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48069",
    "datePublished": "2026-07-14T19:42:32.883Z",
    "dateReserved": "2026-05-20T18:25:25.708Z",
    "dateUpdated": "2026-07-15T13:27:06.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48068 (GCVE-0-2026-48068)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:39 – Updated: 2026-07-21 14:56

Title

@grpc/grps-js: A malformed request can cause a server crash

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:56 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root Scorecard

References

13 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/058665a6…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/1cf4bfa7…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/234f9172…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/455efce8…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b1b7268f…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/e2c035aa…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-node	Affected: < 1.9.16 Affected: >= 1.11.0, < 1.11.4 Affected: >= 1.12.0, < 1.12.7 Affected: >= 1.13.0, < 1.13.5 Affected: >= 1.14.0, < 1.14.4 Affected: >= 1.10.0, < 1.10.12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:56:42.579603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:56:52.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.11.0, \u003c 1.11.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:39:42.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4"
        },
        {
          "name": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"
        }
      ],
      "source": {
        "advisory": "GHSA-5375-pq7m-f5r2",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grps-js: A malformed request can cause a server crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48068",
    "datePublished": "2026-07-14T19:39:42.607Z",
    "dateReserved": "2026-05-20T18:25:25.708Z",
    "dateUpdated": "2026-07-21T14:56:52.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-37168 (GCVE-0-2024-37168)

Vulnerability from cvelistv5 – Published: 2024-06-10 21:32 – Updated: 2024-08-02 03:50

Title

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-11 14:03 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/grpc/grpc-node/security/adviso…	x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/08b0422d…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/674f4e35…	x_refsource_MISC
https://github.com/grpc/grpc-node/commit/a8a02033…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
grpc	grpc-node	Affected: >= 1.10.0, < 1.10.9 Affected: >= 1.9.0, < 1.9.15 Affected: < 1.8.22
grpc	grpc	Affected: 1.10.0 , < 1.10.9 (custom) Affected: 1.9.0 , < 1.9.15 (custom) Affected: 0 , < 1.8.22 (custom) cpe:2.3:a:grpc:grpc:1.10.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:grpc:grpc:1.10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "grpc",
            "vendor": "grpc",
            "versions": [
              {
                "lessThan": "1.10.9",
                "status": "affected",
                "version": "1.10.0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.9.15",
                "status": "affected",
                "version": "1.9.0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.8.22",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T14:03:13.988919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T14:05:45.075Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:50:55.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3"
          },
          {
            "name": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-node",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.15"
            },
            {
              "status": "affected",
              "version": "\u003c 1.8.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T21:32:06.403Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3"
        },
        {
          "name": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb"
        }
      ],
      "source": {
        "advisory": "GHSA-7v5v-9h63-cj86",
        "discovery": "UNKNOWN"
      },
      "title": "@grpc/grpc-js can allocate memory for incoming messages well above configured limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-37168",
    "datePublished": "2024-06-10T21:32:06.403Z",
    "dateReserved": "2024-06-03T17:29:38.330Z",
    "dateUpdated": "2024-08-02T03:50:55.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

12 vulnerabilities found for grpc-node by grpc

CVE-2026-101916 (GCVE-0-2026-101916)

CVE-2026-101915 (GCVE-0-2026-101915)

CVE-2026-101914 (GCVE-0-2026-101914)

CVE-2026-48069 (GCVE-0-2026-48069)

CVE-2026-48068 (GCVE-0-2026-48068)

CVE-2024-37168 (GCVE-0-2024-37168)

CVE-2026-101916 (GCVE-0-2026-101916)

CVE-2026-101915 (GCVE-0-2026-101915)

CVE-2026-101914 (GCVE-0-2026-101914)

CVE-2026-48069 (GCVE-0-2026-48069)

CVE-2026-48068 (GCVE-0-2026-48068)

CVE-2024-37168 (GCVE-0-2024-37168)