{"id":"GHSA-99f4-grh7-6pcq","revision":"2845c9be6f704e01b25198e8039caf50","records":[{"revision":"2845c9be6f704e01b25198e8039caf50","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-99f4-grh7-6pcq","aliases":["CVE-2026-48069"],"title":"@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash","description":"### Impact\nAn invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.","state":0,"publishedAt":"2026-06-11T13:27:44+00:00","modifiedAt":"2026-09-10T03:50:49.185087+00:00","affected":[{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.10.0"},{"kind":"fixed","version":"1.10.12"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.11.0"},{"kind":"fixed","version":"1.11.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.12.0"},{"kind":"fixed","version":"1.12.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.13.0"},{"kind":"fixed","version":"1.13.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@grpc/grpc-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.14.0"},{"kind":"fixed","version":"1.14.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4","https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16"],"sourceUrl":"https://github.com/advisories/GHSA-99f4-grh7-6pcq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-99f4-grh7-6pcq","identifiers":["GHSA-99f4-grh7-6pcq","CVE-2026-48069"]},"retained":false,"historicalAffected":[]}],"coverage":[]}