CVE-2026-48068: gRPC grpc-js denial of service via invalid HTTP/2 stream

CVE-2026-48068 · Severity: high · CVSS 7.5 · Published 2026-07-14

@grpc/grpc-js is a Node.js library that implements gRPC, a high-performance remote procedure call framework widely used in microservices architectures. A vulnerability in the library causes any gRPC server to crash when it receives a specially crafted malformed HTTP/2 request. An attacker can exploit this from the network without authentication to cause denial of service and disrupt business-critical services that depend on the affected gRPC servers.

Technologies: @grpc/grpc-js (npm). Vendors: Grpc, npm.

Quick answers

Is CVE-2026-48068 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48068 being exploited in the wild.
How severe is CVE-2026-48068?
High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?
Grpc-Js < 1.9.16, >= 1.10.0 < 1.10.12, >= 1.11.0 < 1.11.4, >= 1.12.0 < 1.12.7, >= 1.13.0 < 1.13.5, >= 1.14.0 < 1.14.4, < 1.9.16, 1.10.0 - 1.10.11, 1.11.0 - 1.11.3, 1.12.0 - 1.12.6, 1.13.0 - 1.13.4, 1.14.0 - 1.14.3; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.9.16.
Is there a fix for CVE-2026-48068?
Yes. @grpc/grpc-js (npm): upgrade to 1.9.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48068 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48068?
Check whether you run Grpc-Js or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @grpc/grpc-js (npm): upgrade to 1.9.16 or later
    npm install @grpc/grpc-js@1.9.16

Technical details

This vulnerability is an unhandled exception in HTTP/2 stream initialization (CWE-248). The root cause is insufficient validation of incoming HTTP/2 stream headers, allowing malformed requests to trigger uncaught exceptions in the server process. The attack vector is network-based with low complexity and no authentication required. An unauthenticated remote attacker can send a specially crafted malformed HTTP/2 request to a gRPC server to cause an immediate process crash, resulting in denial of service. The vulnerability has been patched in multiple releases across all active version branches, and users should upgrade to 1.9.16 or later (depending on their version series).

Affected products

  • grpc @grpc/grpc-js <1.9.16, 1.10.0-1.10.11, 1.11.0-1.11.3, 1.12.0-1.12.6, 1.13.0-1.13.4, 1.14.0-1.14.3

Identifiers

  • CVE-2026-48068
  • GHSA-5375-pq7m-f5r2

Timeline

  • 2026-05-20: disclosed: Vulnerability publicly disclosed via GitHub Security Advisory
  • 2026-05-20: patched: Patches released in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
  • 2026-06-11: advisory: Published on OSV database as GHSA-5375-pq7m-f5r2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.