Executive brief
A vulnerability in the gRPC JavaScript library can allow a remote attacker to crash both client and server applications. This library is used to facilitate communication between different software services. By sending a specially crafted compressed message, an attacker can trigger a process failure, leading to a denial-of-service condition that disrupts operations.
Technical details
A vulnerability exists in @grpc/grpc-js due to improper handling of malformed compressed data. Specifically, the library fails to catch or handle errors emitted by the zlib decompression stream (e.g., zlib.createInflate) when processing invalid incoming compressed messages. This results in an uncaught exception (CWE-248) that terminates the Node.js process. The issue affects both gRPC clients and servers. Patches have been released across multiple major versions to implement proper error handling in the compression filter and server interceptors.
Affected products
- gRPC grpc-node (@grpc/grpc-js) < 1.9.16, >= 1.10.0 < 1.10.12, >= 1.11.0 < 1.11.4, >= 1.12.0 < 1.12.7, >= 1.13.0 < 1.13.5, >= 1.14.0 < 1.14.4
Timeline
- 2026-07-14: advisory: NVD publication date
- 2026-07-14: disclosed: GitHub Security Advisory GHSA-99f4-grh7-6pcq published
- 2026-05-20: patched: Version 1.10.12 released with fix
References
- https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c
- https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163
- https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5
- https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346
- https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb
- https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12