CVE-2026-48069: @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Other sources
Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js
Patches The following version have fixes for this vulnerability:
- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4
Workarounds There is no workaround.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.14.4 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.13.5 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.12.7 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.11.4 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.10.12 - Upgrade
Upgrade
npm/@grpc/grpc-jsto a version that resolves this vulnerability.Fixed in 1.9.16 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.9.16 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.10.12 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.11.4 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.12.7 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.13.5 - Upgrade
Upgrade
@grpc/grps-js (grpc-js)to a version that resolves this vulnerability.Fixed in 1.14.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48069?
The severity of CVE-2026-48069 is classified as high with a score of 7.5.
What impact does CVE-2026-48069 have on systems?
CVE-2026-48069 can cause a client or server process to crash when an invalid incoming compressed message is received.
How do I fix CVE-2026-48069?
To fix CVE-2026-48069, upgrade to one of the following versions: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4.
Which software is affected by CVE-2026-48069?
CVE-2026-48069 affects all clients and servers that use the npm package @grpc/grpc-js.
Can I implement a workaround for CVE-2026-48069?
While there may be potential workarounds, the most effective solution is to upgrade to the patched versions specified.