{"action":"Upgrade @grpc/grpc-js to 1.9.16 or later.","affected":[{"fixed":"1.9.16","introduced":"0"},{"fixed":"1.10.12","introduced":"1.10.0"},{"fixed":"1.11.4","introduced":"1.11.0"},{"fixed":"1.12.7","introduced":"1.12.0"},{"fixed":"1.13.5","introduced":"1.13.0"},{"fixed":"1.14.4","introduced":"1.14.0"}],"component":"@grpc/grpc-js","cve_ids":["CVE-2026-48068"],"ecosystem":"npm","exploited":false,"fixed_versions":["1.9.16","1.10.12","1.11.4","1.12.7","1.13.5","1.14.4"],"ghsa_id":"GHSA-5375-pq7m-f5r2","id":"tcs_01M5KF2C64N61S37Q6FDGFPSJC","modified_at":"2026-09-10T03:50:48.228812793Z","published_at":"2026-06-11T13:27:54Z","references":["https://osv.dev/vulnerability/GHSA-5375-pq7m-f5r2","https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5375-pq7m-f5r2","url":"https://osv.dev/vulnerability/GHSA-5375-pq7m-f5r2"}],"summary":"@grpc/grpc-js: A malformed request can cause a server crash"}