@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Priority LOW 17CWE-550Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed grpc-node (grpc): 1.13.6, 1.14.5@grpc/grpc-js (npm): 1.13.6, 1.14.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grpc | grpc-node | before 1.13.6; 1.14.0 to before 1.14.5 | 1.13.6, 1.14.5 | Patch available | CNA |
| — | @grpc/grpc-js (npm) | before 1.13.6 | 1.13.6 | Patch available | GHSA-f596-whhp-79r4 |
| — | @grpc/grpc-js (npm) | 1.14.0 to before 1.14.5 | 1.14.5 | Patch available | GHSA-f596-whhp-79r4 |
- grpc-node Vendorgrpc Affected before 1.13.6; 1.14.0 to before 1.14.5 Fixed in 1.13.6, 1.14.5 Patch available CNA
- @grpc/grpc-js (npm) Vendor— Affected before 1.13.6 Fixed in 1.13.6 Patch available GHSA-f596-whhp-79r4
- @grpc/grpc-js (npm) Vendor— Affected 1.14.0 to before 1.14.5 Fixed in 1.14.5 Patch available GHSA-f596-whhp-79r4
Remediation
- Fix · CNA grpc-node (grpc) Fixed in 1.13.6, 1.14.5
- Fix · GHSA-f596-whhp-79r4 @grpc/grpc-js (npm) Fixed in 1.13.6 Advisory →
- Fix · GHSA-f596-whhp-79r4 @grpc/grpc-js (npm) Fixed in 1.14.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-101915
- 2026-10-03 Alias added: GHSA-f596-whhp-79r4
References
Other 7
- https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
- https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
- https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
- https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
- https://github.com/grpc/grpc-node
More grpc vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-25614 gRPC-Go has an authorization bypass via missing leading slash in :path CVSS 3.1CRITICAL 9.1
- TI-2020-06285 Prototype pollution in grpc CVSS 3.1CRITICAL 9.8
- TI-2017-05916 Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based… CVSS 3.0CRITICAL 9.8
- TI-2017-05476 Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
- TI-2017-06843 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-101915 · CVE Program
- CVE-2026-101915 · NVD
- FIRST EPSS
- GHSA-f596-whhp-79r4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences