CVE-2026-48068High· 7.5▾ TwilightA flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
0.6% → 0.9%
Last analysed / modified upstream
A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.
grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation — rated Important by Red Hat. Released 2026-06-11, updated 2026-10-06.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:50850 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:50839
Workarounds / mitigations:
Affected packages:
@grpc/grpc-js < 1.9.16@grpc/grpc-js >= 1.10.0, < 1.10.12@grpc/grpc-js >= 1.11.0, < 1.11.4@grpc/grpc-js >= 1.12.0, < 1.12.7@grpc/grpc-js >= 1.13.0, < 1.13.5@grpc/grpc-js >= 1.14.0, < 1.14.4Patched in:
@grpc/grpc-js 1.9.16@grpc/grpc-js 1.10.12@grpc/grpc-js 1.11.4@grpc/grpc-js 1.12.7@grpc/grpc-js 1.13.5@grpc/grpc-js 1.14.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-13697High· 7.4undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
CVE-2026-64648High· 7.5next: Next.js: Information disclosure via server-side fetch cache (CVE-2026-64648)
CVE-2026-64649High· 8.2next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions (CVE-2026-64649)
CVE-2026-64641High· 7.5next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)
CVE-2026-64645High· 8.2next: Next.js: Server-Side Request Forgery vulnerability (CVE-2026-64645)
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)