CVE-2024-37168
1 advisory.
npm/@grpc/grpc-js CVE-2024-37168: medium 5.3, EPSS 0.67%
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Action: Upgrade @grpc/grpc-js to 1.8.22 or later.
npm i @grpc/grpc-js@1.10.9npm i @grpc/grpc-js@1.9.15npm i @grpc/grpc-js@1.8.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.10.0 | 1.10.9 | - |
| 1.9.0 | 1.9.15 | - |
| 0 | 1.8.22 | - |
Fixed versions
| 1.10.9 | 1.9.15 | 1.8.22 |
Sources
- osv: GHSA-7v5v-9h63-cj86
- https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
- https://nvd.nist.gov/vuln/detail/CVE-2024-37168
- https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
- https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
- https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
- https://github.com/grpc/grpc-node
CVE-2024-37168 · published · modified · JSON