Every CVE Search/ Get API key

CVE-2026-48069

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

7.5 HighFix available

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.88%Up 0.8 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Record
CVE-2026-48069
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
EUVDEUVD-2026-44409 7.5

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Record
EUVD-2026-44409
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-99f4-grh7-6pcq 7.5

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

  • 1.9.16
  • 1.10.12
  • 1.11.4
  • 1.12.7
  • 1.13.5
  • 1.14.4

Workarounds

There is no workaround.

Record
GHSA-99f4-grh7-6pcq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-400
Updated
2026-11-02
NVD 7.5

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Record
CVE-2026-48069
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSV 7.5

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Record
CVE-2026-48069
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVGHSA-99f4-grh7-6pcq 7.5

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

  • 1.9.16
  • 1.10.12
  • 1.11.4
  • 1.12.7
  • 1.13.5
  • 1.14.4

Workarounds

There is no workaround.

Record
GHSA-99f4-grh7-6pcq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248, CWE-400
Updated
2026-11-02
OSVCLSA-2026-1793796156 No score

TuxCare security update for @grpc/grpc-js (4 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 4 CVEs. Fixed in 0.6.9-tuxcare.2.

Record
CLSA-2026-1793796156
Updated
2026-11-04
OSVCLSA-2026-1793796258 No score

TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.2.

Record
CLSA-2026-1793796258
Updated
2026-11-04
OSVROOT-APP-NPM-CVE-2026-48069 No score

CVE-2026-48069 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48069 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-48069
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@grpc/grpc-js
npm
 before 1.9.16
1.9.16
@grpc/grpc-js
npm
 1.10.0 up to 1.10.12
1.10.12
@grpc/grpc-js
npm
 1.11.0 up to 1.11.4
1.11.4
@grpc/grpc-js
npm
 1.12.0 up to 1.12.7
1.12.7
@grpc/grpc-js
npm
 1.13.0 up to 1.13.5
1.13.5
@grpc/grpc-js
npm
 1.14.0 up to 1.14.4
1.14.4
@grpc/grpc-js
TuxCare:npm
From an advisory covering 4 CVEs
 0.6.9-tuxcare.0 up to 0.6.9-tuxcare.2, plus listed versions
0.6.90.6.9-tuxcare.1
0.6.9-tuxcare.2
@grpc/grpc-js
TuxCare:npm
From an advisory covering 2 CVEs
 1.12.6-tuxcare.0 up to 1.12.6-tuxcare.2, plus listed versions
1.12.61.12.6-tuxcare.1
1.12.6-tuxcare.2
@grpc/grpc-js
Root:npm
 before 1.13.4-aikido.1
1.13.4-aikido.11.13.2-aikido.11.14.3-aikido.11.3.8-aikido.11.12.2-aikido.11.12.2-aikido.21.9.15-aikido.11.12.2-aikido.31.14.4-aikido.1
@rootio/grpc__grpc-js
Root:npm
 before 1.13.4-root.io.1
1.13.4-root.io.11.13.2-root.io.11.14.3-root.io.11.3.8-root.io.11.12.2-root.io.11.12.2-root.io.21.9.15-root.io.11.12.2-root.io.31.14.4-root.io.1

History

History
RecordedChangedSources
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48069 is a high vulnerability (CVSS 7.5) in Grpc Grpc-node, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in @grpc/grpc-js 1.9.16.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open