Packages / @grpc/grpc-js / Security

ModerateVulnerabilityGHSA-7v5v-9h63-cj86CVE-2024-37168Published 10 Jun 2024

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Affected releases · @grpc/grpc-js

  • 1.x1.0.0 – 1.10.8Fixed in 1.10.9
  • 0.8.x and older0.1.0 – 0.8.1No fix, no longer updated

On 1.x, the newest line:

npm install @grpc/grpc-js@1.10.9
1.x

  1. Affected

    1.0.0 – 1.8.21

    94 releases

  2. Fixed

    1.8.22

    1 release

  3. Affected

    1.9.0 – 1.9.14

    15 releases

  4. Fixed

    1.9.15 – 1.9.16

    2 releases

  5. Affected

    1.10.0 – 1.10.8

    9 releases

  6. Fixed

    1.10.9 – 1.14.6

    32 releases, latest

0.x

  1. Affected

    0.1.0 – 0.8.1

    49 releases

202 stable releases of @grpc/grpc-js, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @grpc/grpc-js. It is read in your browser and sent nowhere.

What happens

Impact

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

  1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.

  2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Patches

This has been patched in versions 1.10.9, 1.9.15, and 1.8.22