CVE-2026-48068highCWE-248

CVE-2026-48068: high-severity vulnerability in grpc-node

@grpc/grps-js: A malformed request can cause a server crash

Published · Updated

Follow this CVE+ Monitor grpc-node+ Monitor @grpc/grpc-js

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.9%
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
grpc · grpc-node
Related CVEs — grpc-node

In the same product, most dangerous first.

CVE-2026-48069HIGH@grpc/grps-js: An incoming malformed compressed message can cause a client or server crashEPSS 0.9%CVE-2024-37168MEDIUM@grpc/grpc-js can allocate memory for incoming messages well above configured limitsEPSS 0.7%CVE-2026-101915LOW@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesEPSS 0.3%CVE-2026-101914MEDIUM@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesEPSS 0.3%CVE-2026-101916HIGH@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizedEPSS 0.2%