---
id: CVE-2026-48068
aliases:
  - GHSA-5375-pq7m-f5r2
title: '@grpc/grpc-js: A malformed request can cause a server crash'
summary: '@grpc/grpc-js: A malformed request can cause a server crash'
severity: high
cvss: 7.5
cwe:
  - CWE-248
vendor: grpc
product: '@grpc/grpc-js'
ecosystem: npm
affected:
  - '@grpc/grpc-js < 1.9.16'
  - '@grpc/grpc-js >= 1.10.0, < 1.10.12'
  - '@grpc/grpc-js >= 1.11.0, < 1.11.4'
  - '@grpc/grpc-js >= 1.12.0, < 1.12.7'
  - '@grpc/grpc-js >= 1.13.0, < 1.13.5'
  - '@grpc/grpc-js >= 1.14.0, < 1.14.4'
patched:
  - '@grpc/grpc-js 1.9.16'
  - '@grpc/grpc-js 1.10.12'
  - '@grpc/grpc-js 1.11.4'
  - '@grpc/grpc-js 1.12.7'
  - '@grpc/grpc-js 1.13.5'
  - '@grpc/grpc-js 1.14.4'
published: '2026-06-11'
updated: '2026-06-11'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5375-pq7m-f5r2'
references:
  - url: 'https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16'
  - url: 'https://github.com/advisories/GHSA-5375-pq7m-f5r2'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-07T15:41:59.314Z'
epss: 0.00882
epssPercentile: 0.57369
---

## Overview

### Impact
An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.

### Patches
The following version have fixes for this vulnerability:

 - 1.9.16
 - 1.10.12
 - 1.11.4
 - 1.12.7
 - 1.13.5
 - 1.14.4

### Workarounds
There is no workaround.

## Affected packages

- `@grpc/grpc-js < 1.9.16`
- `@grpc/grpc-js >= 1.10.0, < 1.10.12`
- `@grpc/grpc-js >= 1.11.0, < 1.11.4`
- `@grpc/grpc-js >= 1.12.0, < 1.12.7`
- `@grpc/grpc-js >= 1.13.0, < 1.13.5`
- `@grpc/grpc-js >= 1.14.0, < 1.14.4`

## Remediation

Upgrade to a patched release:

- `@grpc/grpc-js 1.9.16`
- `@grpc/grpc-js 1.10.12`
- `@grpc/grpc-js 1.11.4`
- `@grpc/grpc-js 1.12.7`
- `@grpc/grpc-js 1.13.5`
- `@grpc/grpc-js 1.14.4`