Packages / @grpc/grpc-js / Security

HighVulnerabilityGHSA-99f4-grh7-6pcqCVE-2026-48069Published 11 Jun 2026

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Affected releases · @grpc/grpc-js

  • 1.x1.0.0 – 1.14.3Fixed in 1.14.4
  • 0.8.x and older0.1.0 – 0.8.1No fix, no longer updated

On 1.x, the newest line:

npm install @grpc/grpc-js@1.14.4
1.x

  1. Affected

    1.0.0 – 1.9.15

    111 releases

  2. Fixed

    1.9.16

    1 release

  3. Affected

    1.10.0 – 1.10.11

    12 releases

  4. Fixed

    1.10.12

    1 release

  5. Affected

    1.11.0 – 1.11.3

    4 releases

  6. Fixed

    1.11.4

    1 release

  7. Affected

    1.12.0 – 1.12.6

    7 releases

  8. Fixed

    1.12.7

    1 release

  9. Affected

    1.13.0 – 1.13.4

    5 releases

  10. Fixed

    1.13.5 – 1.13.7

    3 releases

  11. Affected

    1.14.0 – 1.14.3

    4 releases

  12. Fixed

    1.14.4 – 1.14.6

    3 releases, latest

0.x

  1. Affected

    0.1.0 – 0.8.1

    49 releases

202 stable releases of @grpc/grpc-js, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @grpc/grpc-js. It is read in your browser and sent nowhere.

What happens

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

  • 1.9.16

  • 1.10.12

  • 1.11.4

  • 1.12.7

  • 1.13.5

  • 1.14.4

Workarounds

There is no workaround.