GHSA-5375-pq7m-f5r2

Suggest an improvement
Source
https://github.com/advisories/GHSA-5375-pq7m-f5r2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5375-pq7m-f5r2
Aliases
  • CVE-2026-48068
Downstream
Related
Published
2026-06-11T13:27:54Z
Modified
2026-06-12T06:14:22.654649104Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
@grpc/grpc-js: A malformed request can cause a server crash
Details

Impact

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.

Patches

The following version have fixes for this vulnerability:

  • 1.9.16
  • 1.10.12
  • 1.11.4
  • 1.12.7
  • 1.13.5
  • 1.14.4

Workarounds

There is no workaround.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-11T13:27:54Z",
    "nvd_published_at": null,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-248"
    ]
}
References

Affected packages

npm
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.9.16

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
1.10.0
Fixed
1.10.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
1.11.0
Fixed
1.11.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
1.12.0
Fixed
1.12.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
1.13.0
Fixed
1.13.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"
@grpc/grpc-js

Package

Name
@grpc/grpc-js
View open source insights on deps.dev
Purl
pkg:npm/%40grpc%2Fgrpc-js

Affected ranges

Type
SEMVER
Events
Introduced
1.14.0
Fixed
1.14.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5375-pq7m-f5r2/GHSA-5375-pq7m-f5r2.json"