Junglewise Threat Intelligence

CVE-2026-48068: gRPC grpc-js denial of service via invalid HTTP/2 stream

CVE-2026-48068 · Severity: high · CVSS 7.5 · Published 2026-07-14

Vendors: Grpc.

Executive brief

@grpc/grpc-js is a Node.js library that implements gRPC, a high-performance remote procedure call framework widely used in microservices architectures. A vulnerability in the library causes any gRPC server to crash when it receives a specially crafted malformed HTTP/2 request. An attacker can exploit this from the network without authentication to cause denial of service and disrupt business-critical services that depend on the affected gRPC servers.

Technical details

This vulnerability is an unhandled exception in HTTP/2 stream initialization (CWE-248). The root cause is insufficient validation of incoming HTTP/2 stream headers, allowing malformed requests to trigger uncaught exceptions in the server process. The attack vector is network-based with low complexity and no authentication required. An unauthenticated remote attacker can send a specially crafted malformed HTTP/2 request to a gRPC server to cause an immediate process crash, resulting in denial of service. The vulnerability has been patched in multiple releases across all active version branches, and users should upgrade to 1.9.16 or later (depending on their version series).

Affected products

  • grpc @grpc/grpc-js <1.9.16, 1.10.0-1.10.11, 1.11.0-1.11.3, 1.12.0-1.12.6, 1.13.0-1.13.4, 1.14.0-1.14.3

Timeline

  • 2026-05-20: disclosed: Vulnerability publicly disclosed via GitHub Security Advisory
  • 2026-05-20: patched: Patches released in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
  • 2026-06-11: advisory: Published on OSV database as GHSA-5375-pq7m-f5r2

References

Related threats