PT-2026-48691 · Npm+3 · @Grpc/Grpc-Js+2

CVE-2026-48068 · Published 2026-06-11 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.9.16 @grpc/grpc-js versions prior to 1.10.12 @grpc/grpc-js versions prior to 1.11.4 @grpc/grpc-js versions prior to 1.12.7 @grpc/grpc-js versions prior to 1.13.5 @grpc/grpc-js versions prior to 1.14.4

Description An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This issue affects all servers created using the library.

Recommendations Update to version 1.9.16. Update to version 1.10.12. Update to version 1.11.4. Update to version 1.12.7. Update to version 1.13.5. Update to version 1.14.4.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-48068

GHSA-5375-PQ7M-F5R2

Affected Products

@Grpc/Grpc-Js

@Rootio/Grpc Grpc-Js

Grpc-Node

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48068.json · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-48068 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5375-pq7m-f5r2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48068 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48068 · Vendor Advisory
• https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 · Note
• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2 · Note
• https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 · Note
• https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 · Note
• https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17 · Note
• https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7 · Note