CVE-2026-48069

Deferred Deferred - Pending Action

Denial of Service in gRPC JavaScript Library

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48069

Affected Vendors & Products

Vendor	Product	Version / Range
grpc	grpc-js	1.9.16
grpc	grpc-js	1.10.12
grpc	grpc-js	1.11.4
grpc	grpc-js	1.12.7
grpc	grpc-js	1.13.5
grpc	grpc-js	1.14.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @grpc/grpc-js library, which implements gRPC functionality in JavaScript. Prior to versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, receiving a malformed compressed message could cause a client or server process to crash. The issue stems from improper error handling during decompression of incoming messages.

Detection Guidance

To detect this vulnerability, check the version of @grpc/grpc-js in your system using commands like 'npm list @grpc/grpc-js' or 'npm ls @grpc/grpc-js'. If the version is below 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4, your system is vulnerable.

Impact Analysis

If you use an affected version of @grpc/grpc-js, a malformed compressed message could crash your gRPC client or server. This leads to denial of service, disrupting communication between services. The crash occurs because the library fails to handle decompression errors gracefully.

Compliance Impact

This vulnerability can impact compliance by causing service outages that violate availability requirements in GDPR and HIPAA. Downtime may lead to unauthorized access to sensitive data during recovery or failure to maintain system integrity, potentially resulting in regulatory penalties.

Mitigation Strategies

Immediately update @grpc/grpc-js to a patched version (1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4 or later). If updating is not possible, consider disabling compressed message handling or implementing network-level protections to filter malformed compressed data.

Hi! I’m here to help you understand CVE-2026-48069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70