Denial of Service in gRPC-JS Server

Executive Summary

CVE-2026-48068 is a vulnerability in the @grpc/grpc-js library, which implements gRPC functionality in JavaScript without a C++ addon. The issue occurs when a server processes an invalid incoming HTTP/2 stream initiation request.

The vulnerability is caused by uncaught error events in HTTP/2 streams, leading to unhandled exceptions. When the server encounters a malformed request, it fails to properly handle the error, resulting in a crash. This affects all servers created with versions of the @grpc/grpc-js package between 1.10.0 and 1.14.3, excluding patched versions.

The fix involves adding error handlers to the HTTP/2 stream objects in the server code. These handlers catch the errors and prevent the server from crashing, even though the stream is already in a bad state. The vulnerability is classified as a denial-of-service (DoS) issue because it allows remote attackers to crash the server without requiring privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires identifying whether your system is running an affected version of the @grpc/grpc-js package. The vulnerability affects versions between 1.10.0 and 1.14.3, excluding the patched versions (1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4).

• Check the installed version of @grpc/grpc-js in your Node.js project by running: npm list @grpc/grpc-js. This will display the currently installed version.
• Review your package.json or package-lock.json files for the @grpc/grpc-js dependency to verify the version.
• Monitor network traffic for malformed HTTP/2 stream initiation requests targeting your gRPC servers. Tools like Wireshark or tcpdump can be used to capture and analyze HTTP/2 traffic, but this requires familiarity with HTTP/2 protocol specifics.

There are no specific commands to detect active exploitation, as the vulnerability is triggered by malformed requests that cause a crash. However, monitoring server logs for unexpected crashes or error events related to HTTP/2 streams may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of the @grpc/grpc-js library in your applications.

• Server crashes: An attacker can send malformed HTTP/2 requests to your server, causing it to crash. This leads to downtime and disrupts the availability of your services.
• Denial-of-service (DoS) attacks: The vulnerability can be exploited to launch DoS attacks, where an attacker repeatedly crashes your server, making it unavailable to legitimate users.
• No privileges required: The attack does not require any special privileges or user interaction, making it easier for attackers to exploit.
• No workarounds: There are no known workarounds for this vulnerability, so upgrading to a patched version is the only way to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR: Under the General Data Protection Regulation (GDPR), organizations must ensure the availability and resilience of processing systems and services. A server crash caused by this vulnerability could lead to service disruptions, potentially violating GDPR requirements for data availability and security.
• HIPAA: The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI). A DoS attack exploiting this vulnerability could disrupt access to ePHI, leading to non-compliance with HIPAA's availability requirements.
• Other standards: Many industry standards, such as ISO 27001 or NIST frameworks, require organizations to protect their systems against vulnerabilities that could lead to service disruptions. Failure to patch this vulnerability could result in non-compliance with these standards.

To maintain compliance, organizations should promptly apply the available patches to mitigate the risk of exploitation and ensure the continued availability and security of their systems.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation for this vulnerability is to upgrade the @grpc/grpc-js package to a patched version. No workarounds are available.

• Upgrade to one of the fixed versions: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. This can be done by running: npm install @grpc/grpc-js@<version>, replacing <version> with the appropriate patched version.
• After upgrading, restart any running gRPC servers to ensure the new version is loaded.
• Verify the upgrade by checking the installed version using: npm list @grpc/grpc-js.

If immediate upgrading is not possible, consider implementing network-level protections such as rate limiting or filtering malformed HTTP/2 requests. However, this is not a substitute for upgrading.

Useful 0 Not Useful 0