CVE Feed

    Dashboard / CVE / CVE-2026-48068

    CVE-2026-48068

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

    Published:Jul 14, 2026
    Last Modified:Aug 3, 2026
    EPS:Jul 14, 2026
    EPSS Score:0.00617
    CVSS Score:7.5

    Affected Products

    Vendor
    Grpc
    Product
    Grpc-node

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-248 Uncaught Exception

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17
    https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7
    https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668
    https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba
    https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903
    https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
    https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
    https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High