Go to packages list

grpc-grpc-js

Ecosystem: npm

Downloads: 270.47 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 4HighAffects 15 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 3 versions
  • 1LowAffects 2 versions
Severity distribution (all time)
6vulnerabilities
  • Critical0 (0.0%)
  • High4 (66.7%)
  • Medium0 (0.0%)
  • Moderate1 (16.7%)
  • Low1 (16.7%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (6)

Known vulnerabilities affecting grpc-grpc-js, based on data from OSV.

Vulnerabilities affecting grpc-grpc-js
IDSeveritySummaryAffected versionsPublishedSource
GHSA-f596-whhp-79r4Low@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages### Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using `@grpc/grpc-js` to run servers. ### Patches This vulnerability is fixed in 1.13.6 and 1.14.5. ### Workarounds This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.
  • < 1.13.6
  • >= 1.14.0, < 1.14.5
GitHub (opens in a new tab)
GHSA-m9gg-hp2v-232jHigh@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized### Impact When server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc/grpc-js` users who use the result of `getAuthContext` for authentication. In particular, `@grpc/grpc-js-xds` can both set the `requireClientCertificate` option to `false` and use the return value of `getAuthContext` for RBAC authentication in some configurations. ### Patches This vulenrability is fixed in 1.13.6 an
  • < 1.13.6
  • >= 1.14.0, < 1.14.5
GitHub (opens in a new tab)
GHSA-5375-pq7m-f5r2High@grpc/grpc-js: A malformed request can cause a server crash### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 ### Workarounds There is no workaround.
  • < 1.9.16
  • >= 1.10.0, < 1.10.12
  • >= 1.11.0, < 1.11.4
  • >= 1.12.0, < 1.12.7
  • >= 1.13.0, < 1.13.5
  • >= 1.14.0, < 1.14.4
GitHub (opens in a new tab)
GHSA-99f4-grh7-6pcqHigh@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 ### Workarounds There is no workaround.
  • < 1.9.16
  • >= 1.10.0, < 1.10.12
  • >= 1.11.0, < 1.11.4
  • >= 1.12.0, < 1.12.7
  • >= 1.13.0, < 1.13.5
  • >= 1.14.0, < 1.14.4
GitHub (opens in a new tab)
GHSA-7v5v-9h63-cj86Moderate@grpc/grpc-js can allocate memory for incoming messages well above configured limits### Impact There are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. ### Patches This has been patched in versions 1.10.9, 1.9.15, and 1.8.22
  • >= 1.10.0, < 1.10.9
  • >= 1.9.0, < 1.9.15
  • < 1.8.22
GitHub (opens in a new tab)
GHSA-pp75-xfpw-37g9HighPrototype pollution in grpc and @grpc/grpc-js"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."
  • < 1.1.8
GitHub (opens in a new tab)
  • GHSA-f596-whhp-79r4Low
    @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
    • < 1.13.6
    • >= 1.14.0, < 1.14.5
    GitHub (opens in a new tab)

    ### Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using `@grpc/grpc-js` to run servers. ### Patches This vulnerability is fixed in 1.13.6 and 1.14.5. ### Workarounds This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.

    CVE: CVE-2026-101915

  • GHSA-m9gg-hp2v-232jHigh
    @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
    • < 1.13.6
    • >= 1.14.0, < 1.14.5
    GitHub (opens in a new tab)

    ### Impact When server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc/grpc-js` users who use the result of `getAuthContext` for authentication. In particular, `@grpc/grpc-js-xds` can both set the `requireClientCertificate` option to `false` and use the return value of `getAuthContext` for RBAC authentication in some configurations. ### Patches This vulenrability is fixed in 1.13.6 an

    CVE: CVE-2026-101916

  • GHSA-5375-pq7m-f5r2High
    @grpc/grpc-js: A malformed request can cause a server crash
    • < 1.9.16
    • >= 1.10.0, < 1.10.12
    • +4 more
    GitHub (opens in a new tab)
    Affected versions:
    • < 1.9.16
    • >= 1.10.0, < 1.10.12
    • >= 1.11.0, < 1.11.4
    • >= 1.12.0, < 1.12.7
    • >= 1.13.0, < 1.13.5
    • >= 1.14.0, < 1.14.4

    ### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 ### Workarounds There is no workaround.

    CVE: CVE-2026-48068

  • GHSA-99f4-grh7-6pcqHigh
    @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
    • < 1.9.16
    • >= 1.10.0, < 1.10.12
    • +4 more
    GitHub (opens in a new tab)
    Affected versions:
    • < 1.9.16
    • >= 1.10.0, < 1.10.12
    • >= 1.11.0, < 1.11.4
    • >= 1.12.0, < 1.12.7
    • >= 1.13.0, < 1.13.5
    • >= 1.14.0, < 1.14.4

    ### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 ### Workarounds There is no workaround.

    CVE: CVE-2026-48069

  • GHSA-7v5v-9h63-cj86Moderate
    @grpc/grpc-js can allocate memory for incoming messages well above configured limits
    • >= 1.10.0, < 1.10.9
    • >= 1.9.0, < 1.9.15
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 1.10.0, < 1.10.9
    • >= 1.9.0, < 1.9.15
    • < 1.8.22

    ### Impact There are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. ### Patches This has been patched in versions 1.10.9, 1.9.15, and 1.8.22

    CVE: CVE-2024-37168

  • GHSA-pp75-xfpw-37g9High
    Prototype pollution in grpc and @grpc/grpc-js
    • < 1.1.8
    GitHub (opens in a new tab)

    "The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."

    CVE: CVE-2020-7768

Showing 1-6 of 6 vulnerabilities