@grpc/grpc-js: A malformed request can cause a server crash (CVE-2026-48068)

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps @grpc/grpc-js (npm), @grpc/grpc-js (npm), @grpc/grpc-js (npm), @grpc/grpc-js (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
@grpc/grpc-jsnpm	<1.9.16	1.9.16
@grpc/grpc-jsnpm	>=1.10.0,<1.10.12	1.10.12
@grpc/grpc-jsnpm	>=1.11.0,<1.11.4	1.11.4
@grpc/grpc-jsnpm	>=1.12.0,<1.12.7	1.12.7
@grpc/grpc-jsnpm	>=1.13.0,<1.13.5	1.13.5
@grpc/grpc-jsnpm	>=1.14.0,<1.14.4	1.14.4
@grpc/grpc-jsnpm	>=0 <1.9.16	1.9.16
@grpc/grpc-jsnpm	>=1.10.0 <1.10.12	1.10.12
@grpc/grpc-jsnpm	>=1.11.0 <1.11.4	1.11.4
@grpc/grpc-jsnpm	>=1.12.0 <1.12.7	1.12.7
@grpc/grpc-jsnpm	>=1.13.0 <1.13.5	1.13.5
@grpc/grpc-jsnpm	>=1.14.0 <1.14.4	1.14.4

Recommended response

Check inventory. Check lockfiles and deployed manifests for @grpc/grpc-js, @grpc/grpc-js, @grpc/grpc-js.
Review the reported fix. Update @grpc/grpc-js to 1.9.16; @grpc/grpc-js to 1.10.12; @grpc/grpc-js to 1.11.4; @grpc/grpc-js to 1.12.7; @grpc/grpc-js to 1.13.5; @grpc/grpc-js to 1.14.4; @grpc/grpc-js to 1.9.16; @grpc/grpc-js to 1.10.12; @grpc/grpc-js to 1.11.4; @grpc/grpc-js to 1.12.7; @grpc/grpc-js to 1.13.5; @grpc/grpc-js to 1.14.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 11, 2026
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Jun 11, 2026

Sources and claim methodology

Upstream source description

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Quoted source text, attributed separately from HOL analysis.