CVE-2026-48068

npm/@grpc/grpc-js CVE-2026-48068: high 7.5

@grpc/grpc-js: A malformed request can cause a server crash

Action: Upgrade @grpc/grpc-js to 1.9.16 or later.

npm i @grpc/grpc-js@1.9.16

npm i @grpc/grpc-js@1.10.12

npm i @grpc/grpc-js@1.11.4

npm i @grpc/grpc-js@1.12.7

npm i @grpc/grpc-js@1.13.5

npm i @grpc/grpc-js@1.14.4

Affected

Fixed versions

Sources

• osv: GHSA-5375-pq7m-f5r2
• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2
• https://github.com/grpc/grpc-node
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16

CVE-2026-48068 · published 2026-06-11T13:27:54Z · modified 2026-09-10T03:50:48.228812793Z · JSON