PT-2026-48692 · Npm · @Grpc/Grpc-Js

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-48069

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-248

CWE-400

Related Identifiers

CVE-2026-48069

GHSA-99F4-GRH7-6PCQ

Affected Products

@Grpc/Grpc-Js

References · 9

• https://osv.dev/vulnerability/GHSA-99f4-grh7-6pcq · Vendor Advisory
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 · Note
• https://github.com/grpc/grpc-node · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 · Note
• https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 · Note
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 · Note