# CVE-2020-7768: gRPC prototype pollution in loadPackageDefinition

Source: https://junglewise.ai/threats/cve-2020-7768-grpc-prototype-pollution-in-loadpackagedefinition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-7768 · Severity: low · CVSS 3.1 · Published 2021-05-10

gRPC is a high-performance remote procedure call (RPC) framework used by applications to communicate over networks. A prototype pollution vulnerability in the loadPackageDefinition function allows attackers to modify object prototypes, potentially leading to denial of service or unexpected application behavior. Applications using affected versions of gRPC or @grpc/grpc-js could be manipulated through specially crafted package definitions.

Technologies: [Grpc](https://junglewise.ai/threats/technologies/grpc), [@grpc/grpc-js (npm)](https://junglewise.ai/threats/technologies/grpc-grpc-js). Vendors: [Grpc](https://junglewise.ai/threats/vendors/grpc), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-7768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-7768 being exploited in the wild.

**How severe is CVE-2020-7768?** Low severity, with a CVSS score of 3.1, published 10 May 2021.

**Which products and versions are affected?** Grpc before 1.24.4; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.1.8.

**Is there a fix for CVE-2020-7768?** Yes. @grpc/grpc-js (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-7768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-7768?** Check whether you run Grpc or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @grpc/grpc-js (npm): upgrade to 1.1.8 or later

  ```sh
  npm install @grpc/grpc-js@1.1.8
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the loadPackageDefinition function of gRPC and @grpc/grpc-js. An attacker can craft malicious package definitions that pollute the JavaScript object prototype, allowing them to inject arbitrary properties into all objects in the application. This requires network access to provide a malicious gRPC service definition; no authentication is required. The primary impact is denial of service through corruption of object properties. Patches are available in grpc 1.24.4 and @grpc/grpc-js 1.1.8.

## Affected products

- gRPC grpc before 1.24.4
- gRPC @grpc/grpc-js before 1.1.8

## Identifiers

- CVE-2020-7768
- GHSA-pp75-xfpw-37g9

## Timeline

- 2020-11-11: disclosed: Vulnerability published in NVD
- 2020-10-23: patched: Fix merged for @grpc/grpc-js in PR #1605
- 2021-05-10: advisory: GHSA-pp75-xfpw-37g9 published

## References

- [https://github.com/grpc/grpc-node/pull/1605](https://github.com/grpc/grpc-node/pull/1605)

## Related threats

- [@grpc/grpc-js authentication context validation bypass](https://junglewise.ai/threats/cve-2026-101916-grpc-grpc-js-implements-the-core-functionality-of-grpc-purely-in)
- [@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages](https://junglewise.ai/threats/cve-2026-101915-grpc-grpc-js-implements-the-core-functionality-of-grpc-purely-in)
- [gRPC @grpc/grpc-js denial of service via malformed compressed message](https://junglewise.ai/threats/cve-2026-48069-grpc-grpc-grpc-js-denial-of-service-via-malformed-compressed)
- [gRPC grpc-js denial of service via invalid HTTP/2 stream](https://junglewise.ai/threats/cve-2026-48068-grpc-grpc-js-denial-of-service-via-invalid-http-2-stream)
- [elixir-grpc RCE and DoS in Erlpack codec](https://junglewise.ai/threats/cve-2026-48853-elixir-grpc-rce-and-dos-in-erlpack-codec)