CVE-2026-48068 @grpc/grps-js: A malformed request can cause a server crash
A malformed HTTP/2 stream initiation can crash servers using the gRPC JavaScript library, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48068?
CVE-2026-48068 is a high-severity denial of service vulnerability in grpc-node, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Weakness: CWE-248
Which versions are affected by CVE-2026-48068?
12 open source packages ship an affected version, including @grpc/grpc-js.
| Package | Affected | Fixed in |
|---|---|---|
@grpc/grpc-js npm | All versions | 1.9.16 |
@grpc/grpc-js npm | All versions | 1.9.16 |
@grpc/grpc-js npm | From 1.10.0 | 1.10.12 |
@grpc/grpc-js npm | From 1.10.0 | 1.10.12 |
@grpc/grpc-js npm | From 1.11.0 | 1.11.4 |
@grpc/grpc-js npm | From 1.11.0 | 1.11.4 |
6 more packages
@grpc/grpc-js npm | From 1.12.0 | 1.12.7 |
@grpc/grpc-js npm | From 1.12.0 | 1.12.7 |
@grpc/grpc-js npm | From 1.13.0 | 1.13.5 |
@grpc/grpc-js npm | From 1.13.0 | 1.13.5 |
@grpc/grpc-js npm | From 1.14.0 | 1.14.4 |
@grpc/grpc-js npm | From 1.14.0 | 1.14.4 |
How do I fix CVE-2026-48068?
Upgrade @grpc/grpc-js to a fixed version for your release line: 1.9.16, 1.10.12, 1.11.4 or 1.12.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48068 being exploited?
There is no known exploitation of CVE-2026-48068 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-WU01571, ECHO-af19-5866-985c, GHSA-5375-pq7m-f5r2, MINI-3vh8-g2vw-q7wj, MINI-46cg-q95v-8r6p, MINI-5mf2-f6qh-3x6v and 17 more.