CVE-2026-48069High· 7.5▾ Twilight@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.6%
0.6% → 0.9%
An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js
The following version have fixes for this vulnerability:
There is no workaround.
@grpc/grpc-js < 1.9.16@grpc/grpc-js >= 1.10.0, < 1.10.12@grpc/grpc-js >= 1.11.0, < 1.11.4@grpc/grpc-js >= 1.12.0, < 1.12.7@grpc/grpc-js >= 1.13.0, < 1.13.5@grpc/grpc-js >= 1.14.0, < 1.14.4Upgrade to a patched release:
@grpc/grpc-js 1.9.16@grpc/grpc-js 1.10.12@grpc/grpc-js 1.11.4@grpc/grpc-js 1.12.7@grpc/grpc-js 1.13.5@grpc/grpc-js 1.14.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48068High· 7.5grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation (CVE-2026-48068)
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
GHSA-8238-w5pm-2374High· 7.5adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
CVE-2026-101901High· 8.2Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-84445High· 8.7gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304High· 7.5gRPC-Go is the Go language implementation of gRPC