{"action":"Upgrade @grpc/grpc-js to 1.9.16 or later.","affected":[{"fixed":"1.9.16","introduced":"0"},{"fixed":"1.10.12","introduced":"1.10.0"},{"fixed":"1.11.4","introduced":"1.11.0"},{"fixed":"1.12.7","introduced":"1.12.0"},{"fixed":"1.13.5","introduced":"1.13.0"},{"fixed":"1.14.4","introduced":"1.14.0"}],"component":"@grpc/grpc-js","cve_ids":["CVE-2026-48069"],"ecosystem":"npm","epss":0.00882,"exploited":false,"fixed_versions":["1.9.16","1.10.12","1.11.4","1.12.7","1.13.5","1.14.4"],"ghsa_id":"GHSA-99f4-grh7-6pcq","id":"tcs_01M5KFFBM7NNPWWQ9TG1H6DJKB","modified_at":"2026-09-10T03:50:49.185087007Z","published_at":"2026-06-11T13:27:44Z","references":["https://osv.dev/vulnerability/GHSA-99f4-grh7-6pcq","https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-99f4-grh7-6pcq","url":"https://osv.dev/vulnerability/GHSA-99f4-grh7-6pcq"}],"summary":"@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash"}