CVE-2026-48069: gRPC @grpc/grpc-js denial of service via malformed compressed message

CVE-2026-48069 · Severity: high · CVSS 7.5 · Published 2026-07-14

A vulnerability in the gRPC JavaScript library can allow a remote attacker to crash both client and server applications. This library is used to facilitate communication between different software services. By sending a specially crafted compressed message, an attacker can trigger a process failure, leading to a denial-of-service condition that disrupts operations.

Technologies: @grpc/grpc-js (npm). Vendors: Grpc, npm.

Quick answers

Is CVE-2026-48069 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48069 being exploited in the wild.
How severe is CVE-2026-48069?
High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?
Grpc-Js < 1.9.16, >= 1.10.0 < 1.10.12, >= 1.11.0 < 1.11.4, >= 1.12.0 < 1.12.7, >= 1.13.0 < 1.13.5, >= 1.14.0 < 1.14.4; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.9.16.
Is there a fix for CVE-2026-48069?
Yes. @grpc/grpc-js (npm): upgrade to 1.9.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48069 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48069?
Check whether you run Grpc-Js or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @grpc/grpc-js (npm): upgrade to 1.9.16 or later
    npm install @grpc/grpc-js@1.9.16

Technical details

A vulnerability exists in @grpc/grpc-js due to improper handling of malformed compressed data. Specifically, the library fails to catch or handle errors emitted by the zlib decompression stream (e.g., zlib.createInflate) when processing invalid incoming compressed messages. This results in an uncaught exception (CWE-248) that terminates the Node.js process. The issue affects both gRPC clients and servers. Patches have been released across multiple major versions to implement proper error handling in the compression filter and server interceptors.

Affected products

  • gRPC grpc-node (@grpc/grpc-js) < 1.9.16, >= 1.10.0 < 1.10.12, >= 1.11.0 < 1.11.4, >= 1.12.0 < 1.12.7, >= 1.13.0 < 1.13.5, >= 1.14.0 < 1.14.4

Identifiers

  • CVE-2026-48069
  • GHSA-99f4-grh7-6pcq

Timeline

  • 2026-07-14: advisory: NVD publication date
  • 2026-07-14: disclosed: GitHub Security Advisory GHSA-99f4-grh7-6pcq published
  • 2026-05-20: patched: Version 1.10.12 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.