{"id":"GHSA-5375-pq7m-f5r2","revision":"553b7e5ddf5e469ca241b2765d10474b","records":[{"revision":"553b7e5ddf5e469ca241b2765d10474b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-5375-pq7m-f5r2","aliases":["CVE-2026-48068"],"title":"@grpc/grpc-js: A malformed request can cause a server crash","description":"### Impact\nAn invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.","state":0,"publishedAt":"2026-06-11T13:27:54+00:00","modifiedAt":"2026-09-10T03:50:48.2288128+00:00","affected":[{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.10.0"},{"kind":"fixed","version":"1.10.12"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.11.0"},{"kind":"fixed","version":"1.11.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.12.0"},{"kind":"fixed","version":"1.12.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.13.0"},{"kind":"fixed","version":"1.13.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.14.0"},{"kind":"fixed","version":"1.14.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"],"sourceUrl":"https://github.com/advisories/GHSA-5375-pq7m-f5r2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5375-pq7m-f5r2","identifiers":["GHSA-5375-pq7m-f5r2","CVE-2026-48068"]},"retained":false,"historicalAffected":[]}],"coverage":[]}