CVE-2026-48068: @grpc/grpc-js A Malformed Request Can Cause Vulnerability
HIGHCVE-2026-48068 is a HIGH (CVSS 7.5) a malformed request can cause vulnerability (CWE-248: Uncaught Exception) affecting @grpc/grpc-js libraries in the npm ecosystem. The issue involves a malformed request can cause a server crash. Remediation is available by upgrading affected packages to version 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4.
CVE-2026-48068 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-48068
To remediate this vulnerability, upgrade all affected @grpc/grpc-js dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @grpc/grpc-js@1.9.16npm install @grpc/grpc-js@1.10.12npm install @grpc/grpc-js@1.11.4npm install @grpc/grpc-js@1.12.7npm install @grpc/grpc-js@1.13.5npm install @grpc/grpc-js@1.14.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @grpc/grpc-jsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-48068, inspect your project dependencies using npm:
npm ls @grpc/grpc-jsAnalyze the terminal output to locate any version of @grpc/grpc-js in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.16), your application is affected.
Note: The npm ls @grpc/grpc-js command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-248: Uncaught Exception, where an exception is thrown from a function, but it is not caught. In @grpc/grpc-js, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-48068 Affected @grpc/grpc-js Versions
6 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@grpc/grpc-js
|
npm |
< 1.9.16
|
1.9.16
|
|
@grpc/grpc-js
|
npm |
≥ 1.10.0
< 1.10.12
|
1.10.12
|
|
@grpc/grpc-js
|
npm |
≥ 1.11.0
< 1.11.4
|
1.11.4
|
|
@grpc/grpc-js
|
npm |
≥ 1.12.0
< 1.12.7
|
1.12.7
|
|
@grpc/grpc-js
|
npm |
≥ 1.13.0
< 1.13.5
|
1.13.5
|
|
@grpc/grpc-js
|
npm |
≥ 1.14.0
< 1.14.4
|
1.14.4
|
References
Frequently Asked Questions
What is CVE-2026-48068?
Which @grpc/grpc-js versions are affected?
What version fixes CVE-2026-48068?
Is @grpc/grpc-js affected?
What is the CVSS score of CVE-2026-48068?
What CWE is associated with CVE-2026-48068?
How can I check npm dependencies for CVE-2026-48068?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5375-pq7m-f5r2",
"modified" : "2026-06-11T13:27:54Z",
"published" : "2026-06-11T13:27:54Z",
"aliases" : [ "CVE-2026-48068" ],
"summary" : "@grpc/grpc-js: A malformed request can cause a server crash",
"details" : "### Impact\nAn invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.9.16"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.10.0"
}, {
"fixed" : "1.10.12"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.11.0"
}, {
"fixed" : "1.11.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.12.0"
}, {
"fixed" : "1.12.7"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.13.0"
}, {
"fixed" : "1.13.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@grpc/grpc-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.14.0"
}, {
"fixed" : "1.14.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/grpc/grpc-node"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4"
}, {
"type" : "WEB",
"url" : "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-248" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-11T13:27:54Z",
"nvd_published_at" : null
}
}