CVE-2026-48069: @grpc/grpc-js Client and Server Crash Due to Malformed Compressed Messages
Summary
CVE-2026-48069: @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash. Affects @grpc/grpc-js across 6 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.12
>= 1.11.0, < 1.11.4
>= 1.12.0, < 1.12.7
>= 1.13.0, < 1.13.5
>= 1.14.0, < 1.14.4
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @grpc/grpc-js package is a JavaScript implementation of gRPC, a high-performance, open-source RPC framework that enables communication between services. It is widely used for building microservices and distributed systems due to its efficiency and support for multiple programming languages. However, this package is vulnerable to a specific issue where an incoming malformed compressed message can lead to a crash of either the client or server process.
Vulnerability Detail
The vulnerability arises from the handling of compressed messages within the @grpc/grpc-js package. When a client or server receives an invalid compressed message, it can trigger a crash, leading to service disruptions. This vulnerability affects all versions of the package prior to the patched versions, making it critical for users to update to avoid potential downtime and instability in their applications.
How To Fix
Latest published version: 1.14.6 as of 23 Oct 2026
npm install @grpc/grpc-js@1.14.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16npm install @grpc/grpc-js@1.9.16 -
>= 1.10.0, < 1.10.121.10.12npm install @grpc/grpc-js@1.10.12 -
>= 1.11.0, < 1.11.41.11.4npm install @grpc/grpc-js@1.11.4 -
>= 1.12.0, < 1.12.71.12.7npm install @grpc/grpc-js@1.12.7 -
>= 1.13.0, < 1.13.51.13.5npm install @grpc/grpc-js@1.13.5 -
>= 1.14.0, < 1.14.41.14.4npm install @grpc/grpc-js@1.14.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. The only effective solution is to update to the patched versions of the package.
Conclusion
In summary, CVE-2026-48069 poses a significant risk to users of the @grpc/grpc-js package by allowing malformed compressed messages to crash client or server processes. It is crucial for users to update to the patched versions to ensure the stability and reliability of their applications.
See every vulnerability recorded for @grpc/grpc-js →
FAQ
CVE-2026-48069 is a vulnerability in the @grpc/grpc-js package that can cause a client or server to crash when processing malformed compressed messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include potential crashes of client or server processes, leading to service interruptions and degraded application performance.
You can update the package by running the command 'npm install @grpc/grpc-js@latest' in your terminal to ensure you have the latest secure version.
No, there is currently no workaround available. The only solution is to update to one of the patched versions of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for @grpc/grpc-js.
