CVE-2026-48068
@grpc/grps-js: A malformed request can cause a server crash
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
@grpc/grps-js: A malformed request can cause a server crash
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Record
CVE-2026-48068- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
EUVDEUVD-2026-44405
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Record
EUVD-2026-44405- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5375-pq7m-f5r2
@grpc/grpc-js: A malformed request can cause a server crash
Impact
An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.
Patches
The following version have fixes for this vulnerability:
- 1.9.16
- 1.10.12
- 1.11.4
- 1.12.7
- 1.13.5
- 1.14.4
Workarounds
There is no workaround.
- Record
GHSA-5375-pq7m-f5r2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
NVD
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Record
CVE-2026-48068- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
OSV
@grpc/grps-js: A malformed request can cause a server crash
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Record
CVE-2026-48068- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
OSVGHSA-5375-pq7m-f5r2
@grpc/grpc-js: A malformed request can cause a server crash
Impact
An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.
Patches
The following version have fixes for this vulnerability:
- 1.9.16
- 1.10.12
- 1.11.4
- 1.12.7
- 1.13.5
- 1.14.4
Workarounds
There is no workaround.
- Record
GHSA-5375-pq7m-f5r2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-248
- Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2026:57590
Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update
- Record
RHSA-2026:57590- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1793796045 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.3.8-tuxcare.2.
- Record
CLSA-2026-1793796045- Updated
- 2026-11-04
OSVCLSA-2026-1793796156 No score
TuxCare security update for @grpc/grpc-js (4 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 4 CVEs. Fixed in 0.6.9-tuxcare.2.
- Record
CLSA-2026-1793796156- Updated
- 2026-11-04
OSVCLSA-2026-1793796258 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.2.
- Record
CLSA-2026-1793796258- Updated
- 2026-11-04
OSVROOT-APP-NPM-CVE-2026-48068 No score
CVE-2026-48068 in @grpc/grpc-js - Patched by Root
Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-48068- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grpc/grpc-jsnpm |
before 1.9.16 | 1.9.16 |
@grpc/grpc-jsnpm |
1.10.0 up to 1.10.12 | 1.10.12 |
@grpc/grpc-jsnpm |
1.11.0 up to 1.11.4 | 1.11.4 |
@grpc/grpc-jsnpm |
1.12.0 up to 1.12.7 | 1.12.7 |
@grpc/grpc-jsnpm |
1.13.0 up to 1.13.5 | 1.13.5 |
@grpc/grpc-jsnpm |
1.14.0 up to 1.14.4 | 1.14.4 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.3.8-tuxcare.0 up to 1.3.8-tuxcare.2, plus listed versions 1.3.81.3.8-tuxcare.1 |
1.3.8-tuxcare.2 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 4 CVEs |
0.6.9-tuxcare.0 up to 0.6.9-tuxcare.2, plus listed versions 0.6.90.6.9-tuxcare.1 |
0.6.9-tuxcare.2 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.12.6-tuxcare.0 up to 1.12.6-tuxcare.2, plus listed versions 1.12.61.12.6-tuxcare.1 |
1.12.6-tuxcare.2 |
rh-podman-desktopRed Hat:enterprise_linux:10.2 From an advisory covering 24 CVEs |
before 0:1.1.2-1.el10_2 | 0:1.1.2-1.el10_2 |
@grpc/grpc-jsRoot:npm |
before 1.13.4-aikido.1 | 1.13.4-aikido.11.13.2-aikido.11.14.3-aikido.11.3.8-aikido.11.12.2-aikido.21.9.15-aikido.11.12.2-aikido.31.14.4-aikido.1 |
@rootio/grpc__grpc-jsRoot:npm |
before 1.13.4-root.io.1 | 1.13.4-root.io.11.13.2-root.io.11.14.3-root.io.11.3.8-root.io.11.12.2-root.io.21.9.15-root.io.11.12.2-root.io.31.14.4-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48068 is a high vulnerability (CVSS 7.5) in Grpc Grpc-node, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in @grpc/grpc-js 1.9.16.
References
github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2
Show 178 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-48068
access.redhat.com/errata/RHSA-2026:57590
bugzilla.redhat.com/show_bug.cgi?id=2455470
issues.redhat.com/browse/RHEL-238929
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json
cve.org/CVERecord?id=CVE-2026-9595
cna.openjsf.org/security-advisories.html
cwe.mitre.org/data/definitions/93.html
html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs.com/package/form-data
pkg.go.dev/github.com/go-jose/go-jose/v4
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json