grpc has 15 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 7 in the last 90 days against 3 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-248 (3) and CWE-863 (3). Most affected products: google.golang.org/grpc (4), grpc (3), grpc-node (3).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 7.5
Publish → KEV: —
Last 90 days: 7 prev 3

Weakness classes

Products

google.golang.org/grpc 4
grpc 3
grpc-node 3
io.grpc:grpc-protobuf 3
@grpc/grpc-js 1
grpc-go 1

Follow grpc:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

grpc vulnerabilities

CVEs affecting grpc, newest first. Open any entry for full detail, references, and exploit status.

15 CVEsRSS

CVE-2026-101916High· 7.4

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…

▾ Twilightgrpc · grpc-nodeEPSS 0.21%via NVD

CVE-2026-101915Low· 3.7

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the stat…

▾ Sunlitgrpc · grpc-nodeEPSS 0.25%via NVD

CVE-2026-101914Medium· 6.5

1mo ago

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparis…

▾ Sunlitgrpc · grpc-nodeEPSS 0.25%via NVD

CVE-2026-84445High· 8.7

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host heade…

▾ Twilightgrpc · grpc-goEPSS 0.64%via NVD

CVE-2026-84303Medium

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are…

▾ Sunlitgrpc · google.golang.org/grpcEPSS 0.31%via NVD

CVE-2026-84304High· 7.5

1mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate…

▾ Twilightgrpc · google.golang.org/grpcEPSS 0.61%via NVD

CVE-2026-53430High

2mo ago

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

▾ Twilightgrpc · grpcEPSS 0.43%via GHSA

GO-2026-6061None

3mo ago

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

▾ Sunlitgrpc · google.golang.org/grpcvia OSV

GHSA-hrxh-6v49-42gfHigh

3mo ago

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

▾ Twilightgrpc · google.golang.org/grpcvia GHSA

CVE-2026-48069High· 7.5

4mo ago

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

▾ Twilightgrpc · @grpc/grpc-jsEPSS 0.88%via GHSA

CVE-2026-33186Critical· 9.1PoC

7mo ago

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logi…

▾ Abyssalgrpc · grpcEPSS 1.6%via NVD

CVE-2023-4785High· 7.5

3y ago

CVEs per month

Weakness classes

Products

Worst active — by depth score

grpc vulnerabilities

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC-Go is the Go language implementation of gRPC

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

gRPC-Go is the Go language implementation of gRPC

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

gRPC connection termination issue

gRPC Reachable Assertion issue

Connection confusion in gRPC