CVE-2024-37168: Memory Allocation Vulnerability in @grpc/grpc-js
Summary
CVE-2024-37168: @grpc/grpc-js can allocate memory for incoming messages well above configured limits. Affects @grpc/grpc-js across 3 version ranges.
< 1.8.22
>= 1.9.0, < 1.9.15
>= 1.10.0, < 1.10.9
Fixed in 1.8.22, 1.9.15 or 1.10.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @grpc/grpc-js package is an npm package that provides a JavaScript implementation of the gRPC (Google Remote Procedure Call) framework. It allows developers to build high-performance, scalable, and interoperable APIs. The package is widely used in various applications and services that require efficient communication between different components. However, a vulnerability has been discovered in versions 1.8.0 to 1.10.8 of the package, which can lead to excessive memory allocation for incoming messages.
Vulnerability Detail
The vulnerability in @grpc/grpc-js allows for memory allocation beyond the configured limits for incoming messages. There are two scenarios where this can occur:
-
If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before being discarded. This can result in excessive memory usage.
-
If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory. On the server side, the message is not discarded, leading to potential memory exhaustion.
These memory allocation issues can have a significant impact on the performance and stability of applications using the affected versions of @grpc/grpc-js.
How To Fix
Latest published version: 1.14.6 as of 23 Oct 2026
npm install @grpc/grpc-js@1.14.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.221.8.22npm install @grpc/grpc-js@1.8.22 -
>= 1.9.0, < 1.9.151.9.15npm install @grpc/grpc-js@1.9.15 -
>= 1.10.0, < 1.10.91.10.9npm install @grpc/grpc-js@1.10.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the patched versions of @grpc/grpc-js to address the issue.
Conclusion
The memory allocation vulnerability in @grpc/grpc-js can have significant implications for the performance and stability of applications using the affected versions. It is crucial to update to the patched versions (1.10.9, 1.9.15, or 1.8.22) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @grpc/grpc-js →
FAQ
@grpc/grpc-js is an npm package that provides a JavaScript implementation of the gRPC framework. It enables developers to build efficient and scalable APIs for inter-component communication.
The vulnerability can result in excessive memory allocation for incoming messages, leading to potential memory exhaustion and performance degradation in applications using the affected versions of @grpc/grpc-js.
To fix this vulnerability, update your @grpc/grpc-js dependency to one of the patched versions: 1.10.9, 1.9.15, or 1.8.22.
No, there are no known workarounds for this vulnerability. Updating to the patched versions is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7v5v-9h63-cj86/GHSA-7v5v-9h63-cj86.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @grpc/grpc-js.
