PT-2026-48691 · Npm · @Grpc/Grpc-Js

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-48068

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-48068

GHSA-5375-PQ7M-F5R2

Affected Products

@Grpc/Grpc-Js

References · 9

• https://osv.dev/vulnerability/GHSA-5375-pq7m-f5r2 · Vendor Advisory
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 · Note
• https://github.com/grpc/grpc-node · Note
• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 · Note