Packages / @grpc/grpc-js / Security

HighVulnerabilityGHSA-pp75-xfpw-37g9CVE-2020-7768Published 10 May 2021

Prototype pollution in grpc and @grpc/grpc-js

Affected releases · @grpc/grpc-js

  • 1.x1.0.0 – 1.1.7Fixed in 1.1.8
  • 0.8.x and older0.1.0 – 0.8.1No fix, no longer updated

On 1.x, the newest line:

npm install @grpc/grpc-js@1.1.8
1.x

  1. Affected

    1.0.0 – 1.1.7

    14 releases

  2. Fixed

    1.1.8 – 1.14.6

    139 releases, latest

0.x

  1. Affected

    0.1.0 – 0.8.1

    49 releases

202 stable releases of @grpc/grpc-js, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @grpc/grpc-js. It is read in your browser and sent nowhere.

What happens

"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."