Read the docs
TI-2026-35510 Aliases CVE-2026-48069GHSA-99f4-grh7-6pcq

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

Priority MEDIUM 41CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00882 59th percentileScored 2026-11-07
Fix Partial grpc-node (grpc): 1.9.16, 1.10.12, 1.11.4 +3@grpc/grpc-js (npm): 1.9.16, 1.10.12, 1.11.4 +3Red Hat: 3 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
grpcgrpc-nodebefore 1.9.16; 1.10.0 to before 1.10.12; 1.11.0 to before 1.11.4; 1.12.0 to before 1.12.7; 1.13.0 to before 1.13.5; 1.14.0 to before 1.14.41.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4Patch availableCNA
—@grpc/grpc-js (npm)before 1.9.161.9.16Patch availableGHSA-99f4-grh7-6pcq
—@grpc/grpc-js (npm)1.10.0 to before 1.10.121.10.12Patch availableGHSA-99f4-grh7-6pcq
—@grpc/grpc-js (npm)1.11.0 to before 1.11.41.11.4Patch availableGHSA-99f4-grh7-6pcq
—@grpc/grpc-js (npm)1.12.0 to before 1.12.71.12.7Patch availableGHSA-99f4-grh7-6pcq
—@grpc/grpc-js (npm)1.13.0 to before 1.13.51.13.5Patch availableGHSA-99f4-grh7-6pcq
—@grpc/grpc-js (npm)1.14.0 to before 1.14.41.14.4Patch availableGHSA-99f4-grh7-6pcq
  • grpc-node Vendorgrpc Affected before 1.9.16; 1.10.0 to before 1.10.12; 1.11.0 to before 1.11.4; 1.12.0 to before 1.12.7; 1.13.0 to before 1.13.5; 1.14.0 to before 1.14.4 Fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4 Patch available CNA
  • @grpc/grpc-js (npm) Vendor— Affected before 1.9.16 Fixed in 1.9.16 Patch available GHSA-99f4-grh7-6pcq
  • @grpc/grpc-js (npm) Vendor— Affected 1.10.0 to before 1.10.12 Fixed in 1.10.12 Patch available GHSA-99f4-grh7-6pcq
  • @grpc/grpc-js (npm) Vendor— Affected 1.11.0 to before 1.11.4 Fixed in 1.11.4 Patch available GHSA-99f4-grh7-6pcq
  • @grpc/grpc-js (npm) Vendor— Affected 1.12.0 to before 1.12.7 Fixed in 1.12.7 Patch available GHSA-99f4-grh7-6pcq
  • @grpc/grpc-js (npm) Vendor— Affected 1.13.0 to before 1.13.5 Fixed in 1.13.5 Patch available GHSA-99f4-grh7-6pcq
  • @grpc/grpc-js (npm) Vendor— Affected 1.14.0 to before 1.14.4 Fixed in 1.14.4 Patch available GHSA-99f4-grh7-6pcq

Remediation

  • Fix · CNA grpc-node (grpc) Fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.9.16 Advisory →
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.10.12 Advisory →
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.11.4 Advisory →
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.12.7 Advisory →
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.13.5 Advisory →
  • Fix · GHSA-99f4-grh7-6pcq @grpc/grpc-js (npm) Fixed in 1.14.4 Advisory →

Red Hat 3 advisories

  • RHSA-2026:52768 Released 2026-08-10 · Red Hat rating Important
    Red Hat Developer Hub 1.9.8 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:49642 Released 2026-08-03 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:48126 Released 2026-07-29 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1.10Fixed RHSA-2026:48126, RHSA-2026:49642
Red Hat Developer Hub 1.9Fixed RHSA-2026:52768
Not affected: 2 products
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48069
  2. 2026-10-03 Alias added: GHSA-99f4-grh7-6pcq
  3. 2026-10-27 Affected versions changed · Red Hat

References

Other 14

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-25614 gRPC-Go has an authorization bypass via missing leading slash in :path CVSS 3.1CRITICAL 9.1
  • TI-2020-06285 Prototype pollution in grpc CVSS 3.1CRITICAL 9.8
  • TI-2017-05916 Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based… CVSS 3.0CRITICAL 9.8
  • TI-2017-05476 Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
  • TI-2017-06843 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences