{"id":"CVE-2024-37168","aliases":["CLSA-2026-1793796045","CLSA-2026-1793796156","EUVD-2024-1970","GHSA-7v5v-9h63-cj86","ROOT-APP-NPM-CVE-2024-37168"],"status":"published","title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00672,"percentile":0.52505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2024-06-10T21:32:06Z","modified":"2026-11-04T19:00:38Z","fixes":[{"ecosystem":"npm","package":"@grpc/grpc-js","fixed_in":["1.10.9","1.9.15","1.8.22"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@grpc/grpc-js","fixed_in":["1.9.15-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/grpc__grpc-js","fixed_in":["1.9.15-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.8-tuxcare.0"},{"fixed":"1.3.8-tuxcare.2"}]}],"versions":["1.3.8","1.3.8-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.9-tuxcare.0"},{"fixed":"0.6.9-tuxcare.2"}]}],"versions":["0.6.9","0.6.9-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.10.9"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.9.0"},{"fixed":"1.9.15"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.22"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/grpc__grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-root.io.1"}]}]}],"products":[{"vendor":"grpc","product":"grpc"},{"vendor":"grpc","product":"grpc-node"}],"references":[{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37168","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7v5v-9h63-cj86"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37168.json","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-37168","title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n","status":"published","published":"2024-06-10T21:32:06.403Z","modified":"2024-08-02T03:50:55.55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-1970","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n","status":"published","published":"2024-06-10T21:32:06Z","modified":"2024-08-02T03:50:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:19.46851Z"}],"ghsa":[{"id":"GHSA-7v5v-9h63-cj86","title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","description":"### Impact\nThere are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option:\n\n 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.\n 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.\n\n### Patches\n\nThis has been patched in versions 1.10.9, 1.9.15, and 1.8.22\n","status":"published","published":"2024-06-10T21:38:05Z","modified":"2024-06-11T21:44:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-37168","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n","status":"published","published":"2024-06-10T22:15:12.433Z","modified":"2026-06-17T07:37:53.1Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:10:04.804473Z"}],"osv":[{"id":"CVE-2024-37168","title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.\n","status":"published","published":"2024-06-10T21:32:06.403Z","modified":"2026-10-28T02:30:31.270773869Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"GHSA-7v5v-9h63-cj86","title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","description":"### Impact\nThere are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option:\n\n 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.\n 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.\n\n### Patches\n\nThis has been patched in versions 1.10.9, 1.9.15, and 1.8.22\n","status":"published","published":"2024-06-10T21:38:05Z","modified":"2026-09-10T03:50:15.135785494Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"CLSA-2026-1793796045","title":"TuxCare security update for @grpc/grpc-js (2 CVEs)","description":"TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.3.8-tuxcare.2.","status":"published","published":"2026-11-04T13:40:46Z","modified":"2026-11-04T19:00:38.939973297Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793796156","title":"TuxCare security update for @grpc/grpc-js (4 CVEs)","description":"TuxCare rebuilt @grpc/grpc-js to address 4 CVEs. Fixed in 0.6.9-tuxcare.2.","status":"published","published":"2026-11-04T13:42:37Z","modified":"2026-11-04T19:00:35.346384603Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"ROOT-APP-NPM-CVE-2024-37168","title":"CVE-2024-37168 in @grpc/grpc-js - Patched by Root","description":"Root has patched CVE-2024-37168 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T06:17:04Z","modified":"2026-10-08T07:15:17.731785613Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}