{"action":"Upgrade @grpc/grpc-js to 1.13.6 or later.","affected":[{"fixed":"1.13.6","introduced":"0"},{"fixed":"1.14.5","introduced":"1.14.0"}],"component":"@grpc/grpc-js","cve_ids":["CVE-2026-101915"],"ecosystem":"npm","epss":0.00251,"exploited":false,"fixed_versions":["1.13.6","1.14.5"],"ghsa_id":"GHSA-f596-whhp-79r4","id":"tcs_01M5KFMGFSWWMZ7AX8PT0HAF49","modified_at":"2026-09-30T15:46:17.948201950Z","published_at":"2026-09-30T15:35:41Z","references":["https://osv.dev/vulnerability/GHSA-f596-whhp-79r4","https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4","https://nvd.nist.gov/vuln/detail/CVE-2026-101915","https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea","https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f","https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6","https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-f596-whhp-79r4","url":"https://osv.dev/vulnerability/GHSA-f596-whhp-79r4"}],"summary":"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages"}