---
id: CVE-2026-48069
aliases:
  - GHSA-99f4-grh7-6pcq
title: >-
  @grpc/grpc-js: An incoming malformed compressed message can cause a client or
  server crash
summary: >-
  @grpc/grpc-js: An incoming malformed compressed message can cause a client or
  server crash
severity: high
cvss: 7.5
cwe:
  - CWE-248
  - CWE-400
vendor: grpc
product: '@grpc/grpc-js'
ecosystem: npm
affected:
  - '@grpc/grpc-js < 1.9.16'
  - '@grpc/grpc-js >= 1.10.0, < 1.10.12'
  - '@grpc/grpc-js >= 1.11.0, < 1.11.4'
  - '@grpc/grpc-js >= 1.12.0, < 1.12.7'
  - '@grpc/grpc-js >= 1.13.0, < 1.13.5'
  - '@grpc/grpc-js >= 1.14.0, < 1.14.4'
patched:
  - '@grpc/grpc-js 1.9.16'
  - '@grpc/grpc-js 1.10.12'
  - '@grpc/grpc-js 1.11.4'
  - '@grpc/grpc-js 1.12.7'
  - '@grpc/grpc-js 1.13.5'
  - '@grpc/grpc-js 1.14.4'
published: '2026-06-11'
updated: '2026-06-11'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-99f4-grh7-6pcq'
references:
  - url: 'https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4'
  - url: 'https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16'
  - url: 'https://github.com/advisories/GHSA-99f4-grh7-6pcq'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-07T15:41:59.316Z'
epss: 0.00882
epssPercentile: 0.57647
---

## Overview

### Impact
An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

### Patches
The following version have fixes for this vulnerability:

 - 1.9.16
 - 1.10.12
 - 1.11.4
 - 1.12.7
 - 1.13.5
 - 1.14.4

### Workarounds
There is no workaround.

## Affected packages

- `@grpc/grpc-js < 1.9.16`
- `@grpc/grpc-js >= 1.10.0, < 1.10.12`
- `@grpc/grpc-js >= 1.11.0, < 1.11.4`
- `@grpc/grpc-js >= 1.12.0, < 1.12.7`
- `@grpc/grpc-js >= 1.13.0, < 1.13.5`
- `@grpc/grpc-js >= 1.14.0, < 1.14.4`

## Remediation

Upgrade to a patched release:

- `@grpc/grpc-js 1.9.16`
- `@grpc/grpc-js 1.10.12`
- `@grpc/grpc-js 1.11.4`
- `@grpc/grpc-js 1.12.7`
- `@grpc/grpc-js 1.13.5`
- `@grpc/grpc-js 1.14.4`