CVE-2026-48069 @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
A malformed compressed message can crash gRPC clients or servers using the @grpc/grpc-js library, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48069?
CVE-2026-48069 is a high-severity denial of service vulnerability in grpc-node, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Weakness: CWE-248
Which versions are affected by CVE-2026-48069?
12 open source packages ship an affected version, including @grpc/grpc-js.
| Package | Affected | Fixed in |
|---|---|---|
@grpc/grpc-js npm | All versions | 1.9.16 |
@grpc/grpc-js npm | All versions | 1.9.16 |
@grpc/grpc-js npm | From 1.10.0 | 1.10.12 |
@grpc/grpc-js npm | From 1.10.0 | 1.10.12 |
@grpc/grpc-js npm | From 1.11.0 | 1.11.4 |
@grpc/grpc-js npm | From 1.11.0 | 1.11.4 |
6 more packages
@grpc/grpc-js npm | From 1.12.0 | 1.12.7 |
@grpc/grpc-js npm | From 1.12.0 | 1.12.7 |
@grpc/grpc-js npm | From 1.13.0 | 1.13.5 |
@grpc/grpc-js npm | From 1.13.0 | 1.13.5 |
@grpc/grpc-js npm | From 1.14.0 | 1.14.4 |
@grpc/grpc-js npm | From 1.14.0 | 1.14.4 |
How do I fix CVE-2026-48069?
Upgrade @grpc/grpc-js to a fixed version for your release line: 1.9.16, 1.10.12, 1.11.4 or 1.12.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48069 being exploited?
There is no known exploitation of CVE-2026-48069 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-PA44316, ECHO-63f9-6002-8680, GHSA-99f4-grh7-6pcq, MINI-2jvw-6wjw-9h82, MINI-46qj-h96g-c9r9, MINI-4f79-wrfq-h4h6 and 17 more.