CVE-2026-48068
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
@grpc/grps-js: A malformed request can cause a server crash
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
grpc-node
- Vendor
- grpc
- Product
- grpc-node
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| < 1.9.16 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.11.0, < 1.11.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.12.0, < 1.12.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.13.0, < 1.13.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.14.0, < 1.14.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.10.0, < 1.10.12 | affected | Unavailable | Unavailable | Unavailable | None listed |