@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00617.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
grpc grpc-node affected
Version Status Constraints
< 1.9.16 affected —
>= 1.11.0, < 1.11.4 affected —
>= 1.12.0, < 1.12.7 affected —
>= 1.13.0, < 1.13.5 affected —
>= 1.14.0, < 1.14.4 affected —
>= 1.10.0, < 1.10.12 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crash
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17 cve-icon
https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7 cve-icon
https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668 cve-icon
https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba cve-icon
https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903 cve-icon
https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 cve-icon
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 cve-icon
https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2 cve-icon
History

Tue, 21 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Title @grpc/grps-js: A malformed request can cause a server crash
Weaknesses CWE-248
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-21T14:56:52.473Z

Reserved: 2026-05-20T18:25:25.708Z

Link: CVE-2026-48068

cve-icon Vulnrichment

Updated: 2026-07-21T14:56:47.440Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T09:15:12Z

Weaknesses