CVE-2026-101915
Received Received - Intake

Sensitive Data Exposure in @grpc/grpc-js via Error Messages

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-29
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101915
EUVD
EUVD-2026-88468

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
grpc grpc-js to 1.14.5 (exc)
grpc grpc-js to 1.13.6 (inc)
grpc grpc-js From 1.14.0 (inc) to 1.14.5 (exc)
grpc grpc-js to 1.14.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-550 Certain conditions, such as network failure, will cause a server error message to be displayed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @grpc/grpc-js library, which implements gRPC functionality in JavaScript. When a server method handler throws an uncaught error, the server includes the error message in the status sent to the client. This can expose sensitive data if the error message contains confidential information. The issue is fixed in versions 1.13.6 and 1.14.5.

Detection Guidance

To detect this vulnerability, check the version of @grpc/grpc-js installed in your system using the command: npm list @grpc/grpc-js. If the version is below 1.13.6 or between 1.14.0 and 1.14.4, the system is vulnerable.

Impact Analysis

An attacker could exploit this to access sensitive error details from your server, such as internal stack traces, database queries, or other confidential information. This could lead to further attacks or data breaches. The vulnerability requires no special privileges or user interaction to exploit.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update @grpc/grpc-js to version 1.13.6 or 1.14.5 or later using the command: npm update @grpc/grpc-js. Alternatively, implement a top-level error handler to strip sensitive details from error messages before they are sent to clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart