Skip to content
Fencer Vulns
high 7.5

CVE-2026-48069 json

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

published 2026-06-11 4 mo ago modified 2026-10-24 15 d ago also GHSA-99f4-grh7-6pcq , EUVD-2026-44409

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Patch / fix

  • npm @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48069 updated cvss 7.5

grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message

  • Red Hat Build of Podman Desktop grpc-js Red Hat Developer Hub 1 grpc-js Red Hat Enterprise Linux AI (RHEL AI) 3 grpc-js Red Hat OpenShift Dev Spaces grpc-js Red Hat Self-service automation portal 2 grpc-js
    affected: workaround, no fix available “Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.”
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1785972843
    fixed: vendor fix “Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.” RHSA-2026:52768
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1785411652, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1785332825, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki 1785332668, rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator 1785332694
    fixed: vendor fix “Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.” RHSA-2026:48126
  • Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1785972533, rhdh/rhdh-operator-bundle 1785976147 Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1785411290, rhdh/rhdh-operator-bundle 1785415596, rhdh/rhdh-must-gather-rhel9 1784202439, rhdh/rhdh-rag-content-rhel9 1785162496, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1785333413, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1785340831, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm @grpc/grpc-js
<1.9.16
>=1.10.0, <1.10.12
>=1.11.0, <1.11.4
>=1.12.0, <1.12.7
>=1.13.0, <1.13.5
>=1.14.0, <1.14.4
1.9.16
1.10.12
1.11.4
1.12.7
1.13.5
1.14.4

Affected products

  • grpc grpc-node

Classification

Weakness
  • CWE-248 Uncaught Exception
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.