CVE-2026-48068: @grpc/grps-js: A malformed request can cause a server crash
@grpc/grpc-js is a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround. Fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Other sources
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
— MITRE
Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.
Patches The following version have fixes for this vulnerability:
- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4
Workarounds There is no workaround.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.14.4 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.13.5 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.12.7 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.11.4 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.10.12 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.9.16 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.9.16 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.10.12 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.11.4 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.12.7 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.13.5 - Upgrade
Upgrade
@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.14.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48068?
CVE-2026-48068 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-48068?
To fix CVE-2026-48068, upgrade to one of the patched versions: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4.
What impact does CVE-2026-48068 have on my server?
CVE-2026-48068 can cause server processes to crash when an invalid incoming HTTP/2 stream initiation is received.
Which software is affected by CVE-2026-48068?
CVE-2026-48068 affects all servers created using the npm package @grpc/grpc-js.
Are there any workarounds for CVE-2026-48068?
There are no specific workarounds available for CVE-2026-48068, so upgrading to the patched versions is recommended.