CVE-2020-7768: Prototype Pollution in grpc and @grpc/grpc-js
Summary
CVE-2020-7768: Prototype pollution in grpc and @grpc/grpc-js. Affects grpc versions < 1.24.4. Fixed in 1.24.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grpc package is a Node.js library that provides a high-performance, open-source framework for building scalable, bidirectional communication applications. It allows developers to create efficient and reliable communication channels between clients and servers. Similarly, the @grpc/grpc-js package is a JavaScript implementation of the gRPC protocol, which enables communication between clients and servers in various programming languages. Both packages are widely used in the Node.js ecosystem for building distributed systems and microservices.
Vulnerability Detail
This vulnerability, identified as CVE-2020-7768, is related to prototype pollution. Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing objects, leading to unexpected behavior or even remote code execution. In the case of grpc and @grpc/grpc-js, the vulnerability arises from the improper handling of user-supplied input during the loading of package definitions. An attacker can exploit this vulnerability to modify the prototype of an object, potentially leading to the execution of arbitrary code or unauthorized access to sensitive information. The impact of this vulnerability is considered high, with a CVSS score of 7.5.
How To Fix
Latest published version: 1.24.11 as of 22 Oct 2026
npm install grpc@1.24.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24.4
This is the first release that contains the fix.
npm install grpc@1.24.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected packages to the fixed versions mentioned above.
Conclusion
In conclusion, the grpc and @grpc/grpc-js packages are vulnerable to prototype pollution, which can be exploited by an attacker to execute arbitrary code or gain unauthorized access to sensitive information. To mitigate this risk, it is crucial to update the packages to the fixed versions mentioned above. Additionally, it is recommended to stay informed about security vulnerabilities in open-source software and regularly update dependencies to ensure the security of your applications.
See every vulnerability recorded for grpc →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing objects, leading to unexpected behavior or even remote code execution. It is a common security issue in JavaScript and other languages that support object-oriented programming.
The impact of this vulnerability is considered high, with a CVSS score of 7.5. An attacker can exploit this vulnerability to modify the prototype of an object, potentially leading to the execution of arbitrary code or unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to update the grpc package to version 1.24.4 or later, and the @grpc/grpc-js package to version 1.1.8 or later. Updating to these fixed versions ensures that the packages properly handle user-supplied input and mitigate the risk of prototype pollution.
There is no known workaround for this vulnerability. It is essential to update the affected packages to the fixed versions mentioned above.
You can find more information about this vulnerability in the GitHub Security Advisory database. The links to the advisory for the grpc package and the @grpc/grpc-js package are provided in the 'affected' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
