{"id":"CVE-2026-48069","aliases":["CLSA-2026-1793796156","CLSA-2026-1793796258","EUVD-2026-44409","GHSA-99f4-grh7-6pcq","ROOT-APP-NPM-CVE-2026-48069"],"status":"published","title":"@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00882,"percentile":0.59409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-400"],"published":"2026-06-11T13:27:44Z","modified":"2026-11-04T19:00:39Z","fixes":[{"ecosystem":"npm","package":"@grpc/grpc-js","fixed_in":["1.9.16","1.10.12","1.11.4","1.12.7","1.13.5","1.14.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@grpc/grpc-js","fixed_in":["1.13.4-aikido.1","1.13.2-aikido.1","1.14.3-aikido.1","1.3.8-aikido.1","1.12.2-aikido.1","1.12.2-aikido.2","1.9.15-aikido.1","1.12.2-aikido.3","1.14.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/grpc__grpc-js","fixed_in":["1.13.4-root.io.1","1.13.2-root.io.1","1.14.3-root.io.1","1.3.8-root.io.1","1.12.2-root.io.1","1.12.2-root.io.2","1.9.15-root.io.1","1.12.2-root.io.3","1.14.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.12"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.9-tuxcare.0"},{"fixed":"0.6.9-tuxcare.2"}]}],"versions":["0.6.9","0.6.9-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.6-tuxcare.0"},{"fixed":"1.12.6-tuxcare.2"}]}],"versions":["1.12.6","1.12.6-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.16"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.10.12"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@grpc/grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-aikido.1"},{"fixed":"1.13.2-aikido.1"},{"fixed":"1.14.3-aikido.1"},{"fixed":"1.3.8-aikido.1"},{"fixed":"1.12.2-aikido.1"},{"fixed":"1.12.2-aikido.2"},{"fixed":"1.9.15-aikido.1"},{"fixed":"1.12.2-aikido.3"},{"fixed":"1.14.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/grpc__grpc-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-root.io.1"},{"fixed":"1.13.2-root.io.1"},{"fixed":"1.14.3-root.io.1"},{"fixed":"1.3.8-root.io.1"},{"fixed":"1.12.2-root.io.1"},{"fixed":"1.12.2-root.io.2"},{"fixed":"1.9.15-root.io.1"},{"fixed":"1.12.2-root.io.3"},{"fixed":"1.14.4-root.io.1"}]}]}],"products":[{"vendor":"grpc","product":"grpc-node"}],"references":[{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-99f4-grh7-6pcq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48069.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48069","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48069","title":"@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.","status":"published","published":"2026-07-14T19:42:32.883Z","modified":"2026-07-15T13:27:06.2Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-44409","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.","status":"published","published":"2026-07-14T19:42:32Z","modified":"2026-07-15T13:27:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-99f4-grh7-6pcq","title":"@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash","description":"### Impact\nAn invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.","status":"published","published":"2026-06-11T13:27:44Z","modified":"2026-06-11T13:27:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-400"],"updated_at":"2026-11-02T14:40:26.12116Z"}],"nvd":[{"id":"CVE-2026-48069","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.","status":"published","published":"2026-07-14T20:17:05.867Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-48069","title":"@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash","description":"@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.","status":"published","published":"2026-07-14T19:42:32.883Z","modified":"2026-10-28T02:30:58.326865295Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-99f4-grh7-6pcq","title":"@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash","description":"### Impact\nAn invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.","status":"published","published":"2026-06-11T13:27:44Z","modified":"2026-09-10T03:50:49.185087007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-400"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"CLSA-2026-1793796156","title":"TuxCare security update for @grpc/grpc-js (4 CVEs)","description":"TuxCare rebuilt @grpc/grpc-js to address 4 CVEs. Fixed in 0.6.9-tuxcare.2.","status":"published","published":"2026-11-04T13:42:37Z","modified":"2026-11-04T19:00:35.346384603Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793796258","title":"TuxCare security update for @grpc/grpc-js (2 CVEs)","description":"TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.2.","status":"published","published":"2026-11-04T13:44:19Z","modified":"2026-11-04T19:00:39.153992189Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"ROOT-APP-NPM-CVE-2026-48069","title":"CVE-2026-48069 in @grpc/grpc-js - Patched by Root","description":"Root has patched CVE-2026-48069 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-12T09:53:45Z","modified":"2026-10-12T10:15:05.773748673Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}