# Grpc vulnerabilities

Source: https://junglewise.ai/threats/vendors/grpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/grpc.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 8 vulnerabilities in Grpc: 2 in the last 7 days and 2 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-128065, was published on 13 November 2026. Nothing was published in the last eight weeks. 1 technology has a page of its own.

## Counts

- Last 7 days: 2
- Last 30 days: 2
- Last 90 days: 2
- All time: 8 (2 critical, 0 exploited in the wild)

## About Grpc

gRPC is an open-source remote procedure call framework originally developed by Google.

## Latest Grpc vulnerabilities

- [CVE-2026-128065: grpc-js-xds RBAC override policy bypass](https://junglewise.ai/threats/cve-2026-128065-grpc-grpc-js-rbac-override-configs-in-virtualhost-and-route) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-126367: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and…](https://junglewise.ai/threats/cve-2026-126367-grpc-grpc-js-safe-regex-incorrectly-applies-partial-string) (medium, CVSS 4.8, published 13 Nov 2026)
- [gRPC-Go auth bypass and DoS in xDS RBAC and HTTP/2 transport](https://junglewise.ai/threats/grpc-go-auth-bypass-and-dos-in-xds-rbac-and-http-2-transport-878951d5) (high, CVSS 8.8, published 21 Jul 2026)
- [CVE-2026-48069: gRPC @grpc/grpc-js denial of service via malformed compressed message](https://junglewise.ai/threats/cve-2026-48069-grpc-grpc-grpc-js-denial-of-service-via-malformed-compressed) (high, CVSS 7.5, published 14 Jul 2026)
- [CVE-2026-48068: gRPC grpc-js denial of service via invalid HTTP/2 stream](https://junglewise.ai/threats/cve-2026-48068-grpc-grpc-js-denial-of-service-via-invalid-http-2-stream) (high, CVSS 7.5, published 14 Jul 2026)
- [CVE-2026-48853: elixir-grpc RCE and DoS in Erlpack codec](https://junglewise.ai/threats/cve-2026-48853-elixir-grpc-rce-and-dos-in-erlpack-codec) (critical, CVSS 9.2, published 15 Jun 2026)
- [CVE-2026-33186: gRPC gRPC-Go authorization bypass in HTTP/2 path validation](https://junglewise.ai/threats/cve-2026-33186-grpc-grpc-go-authorization-bypass-in-http-2-path-validation) (critical, CVSS 9.1, published 20 Mar 2026)
- [CVE-2020-7768: gRPC prototype pollution in loadPackageDefinition](https://junglewise.ai/threats/cve-2020-7768-grpc-prototype-pollution-in-loadpackagedefinition) (low, CVSS 3.1, published 10 May 2021)

## Most severe Grpc vulnerabilities

- [CVE-2026-48853: elixir-grpc RCE and DoS in Erlpack codec](https://junglewise.ai/threats/cve-2026-48853-elixir-grpc-rce-and-dos-in-erlpack-codec) (critical, CVSS 9.2, published 15 Jun 2026)
- [CVE-2026-33186: gRPC gRPC-Go authorization bypass in HTTP/2 path validation](https://junglewise.ai/threats/cve-2026-33186-grpc-grpc-go-authorization-bypass-in-http-2-path-validation) (critical, CVSS 9.1, published 20 Mar 2026)
- [gRPC-Go auth bypass and DoS in xDS RBAC and HTTP/2 transport](https://junglewise.ai/threats/grpc-go-auth-bypass-and-dos-in-xds-rbac-and-http-2-transport-878951d5) (high, CVSS 8.8, published 21 Jul 2026)
- [CVE-2026-48069: gRPC @grpc/grpc-js denial of service via malformed compressed message](https://junglewise.ai/threats/cve-2026-48069-grpc-grpc-grpc-js-denial-of-service-via-malformed-compressed) (high, CVSS 7.5, published 14 Jul 2026)
- [CVE-2026-48068: gRPC grpc-js denial of service via invalid HTTP/2 stream](https://junglewise.ai/threats/cve-2026-48068-grpc-grpc-js-denial-of-service-via-invalid-http-2-stream) (high, CVSS 7.5, published 14 Jul 2026)
- [CVE-2026-126367: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and…](https://junglewise.ai/threats/cve-2026-126367-grpc-grpc-js-safe-regex-incorrectly-applies-partial-string) (medium, CVSS 4.8, published 13 Nov 2026)
- [CVE-2026-128065: grpc-js-xds RBAC override policy bypass](https://junglewise.ai/threats/cve-2026-128065-grpc-grpc-js-rbac-override-configs-in-virtualhost-and-route) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2020-7768: gRPC prototype pollution in loadPackageDefinition](https://junglewise.ai/threats/cve-2020-7768-grpc-prototype-pollution-in-loadpackagedefinition) (low, CVSS 3.1, published 10 May 2021)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 2 | 0 | 0 |

## Grpc technologies

- [Grpc](https://junglewise.ai/threats/technologies/grpc): 6 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grpc vulnerabilities", https://junglewise.ai/threats/vendors/grpc, 13 November 2026.