CVE-2026-48069

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48069

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48069.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-48069

Aliases

GHSA-99f4-grh7-6pcq

Downstream

CGA (60)

CLEANSTART (2)

MINI (19)

ROOT (1)

ROOT-APP-NPM-CVE-2026-48069

Published

2026-07-14T19:42:32Z

Modified

2026-10-15T10:49:59Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

Details

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48069.json"
}

References

Affected packages

Git / github.com/grpc/grpc-node

Affected ranges

Type

GIT

Repo

https://github.com/grpc/grpc-node

Events

Introduced

Fixed

0acbec32a4fd6ca25b9135dfec3c03c8cafbbe25

Introduced

190a72ecd09de91013137b67d8e9e1d6da2eb7c8

Fixed

2c99fbddc969c3f377297d400e7b5a320e5c5de2

Introduced

1b9b9897e34f1000ba5d2eba13a2193e2f6e696e

Fixed

3f6b0e3a3d301c0e9f6783023e8701e6bcccd794

Introduced

8d6b590adc8d027487bb72264751de2e27fab4cb

Fixed

49f700b8c3c875021c2862967349becc3e1769a0

Introduced

b003f82776e1839e568f40779df6f7cc9a77c8ba

Fixed

d646ccd967b3e927f0ceb9291916049d8b1d3346

Introduced

7db315d094b737f105fd7265dd69ab6d2a7bb2a1

Fixed

a380735ba9b0351214f2faa578350a559dd486ff

Fixed

2375eadcc52ca2b1ef55288bcd6355168b02706c

Fixed

2fe55fd76a8bb59eaab5f39e3552b5f84985a163

Fixed

4091bd902105f8fb655741758aee71418c48b5d5

Fixed

b3f16094473b5c8f38b0955eafa4a19507127346

Fixed

b61c4d65953db85c2ae55b4b3cd98a4259dc87cb

Fixed

b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.9.16"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.10.0"
                },
                {
                    "fixed":  "1.10.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.11.0"
                },
                {
                    "fixed":  "1.11.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.12.0"
                },
                {
                    "fixed":  "1.12.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.13.0"
                },
                {
                    "fixed":  "1.13.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "fixed":  "1.14.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "2375eadcc52ca2b1ef55288bcd6355168b02706c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "2fe55fd76a8bb59eaab5f39e3552b5f84985a163"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "4091bd902105f8fb655741758aee71418c48b5d5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "b3f16094473b5c8f38b0955eafa4a19507127346"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "b61c4d65953db85c2ae55b4b3cd98a4259dc87cb"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@grpc/grpc-js-xds@1.*

@grpc/grpc-js-xds@1.10.0

@grpc/grpc-js-xds@1.10.1

@grpc/grpc-js-xds@1.11.0

@grpc/grpc-js-xds@1.12.0

@grpc/grpc-js-xds@1.12.1

@grpc/grpc-js-xds@1.12.2

@grpc/grpc-js-xds@1.13.0

@grpc/grpc-js-xds@1.14.0

@grpc/grpc-js-xds@1.8.0

@grpc/grpc-js-xds@1.9.0

@grpc/grpc-js-xds@1.9.1

@grpc/grpc-js-xds@1.9.2

@grpc/grpc-js@1.*

@grpc/grpc-js@1.10.0

@grpc/grpc-js@1.10.1

@grpc/grpc-js@1.10.10

@grpc/grpc-js@1.10.11

@grpc/grpc-js@1.10.2

@grpc/grpc-js@1.10.3

@grpc/grpc-js@1.10.4

@grpc/grpc-js@1.10.5

@grpc/grpc-js@1.10.6

@grpc/grpc-js@1.10.7

@grpc/grpc-js@1.10.8

@grpc/grpc-js@1.10.9

@grpc/grpc-js@1.11.0

@grpc/grpc-js@1.11.1

@grpc/grpc-js@1.11.2

@grpc/grpc-js@1.11.3

@grpc/grpc-js@1.12.0

@grpc/grpc-js@1.12.1

@grpc/grpc-js@1.12.2

@grpc/grpc-js@1.12.3

@grpc/grpc-js@1.12.4

@grpc/grpc-js@1.12.5

@grpc/grpc-js@1.12.6

@grpc/grpc-js@1.13.0

@grpc/grpc-js@1.13.1

@grpc/grpc-js@1.13.2

@grpc/grpc-js@1.13.3

@grpc/grpc-js@1.13.4

@grpc/grpc-js@1.14.0

@grpc/grpc-js@1.14.1

@grpc/grpc-js@1.14.2

@grpc/grpc-js@1.14.3

@grpc/grpc-js@1.8.0

@grpc/grpc-js@1.9.0

@grpc/grpc-js@1.9.1

@grpc/grpc-js@1.9.10

@grpc/grpc-js@1.9.11

@grpc/grpc-js@1.9.12

@grpc/grpc-js@1.9.13

@grpc/grpc-js@1.9.14

@grpc/grpc-js@1.9.15

@grpc/grpc-js@1.9.2

@grpc/grpc-js@1.9.3

@grpc/grpc-js@1.9.4

@grpc/grpc-js@1.9.5

@grpc/grpc-js@1.9.6

@grpc/grpc-js@1.9.7

@grpc/grpc-js@1.9.8

@grpc/grpc-js@1.9.9

@grpc/proto-loader@0.*

@grpc/proto-loader@0.7.10

@grpc/proto-loader@0.7.11

@grpc/proto-loader@0.7.12

@grpc/proto-loader@0.7.13

@grpc/proto-loader@0.7.14

@grpc/proto-loader@0.7.15

@grpc/proto-loader@0.7.4

@grpc/proto-loader@0.7.5

@grpc/proto-loader@0.7.6

@grpc/proto-loader@0.7.7

@grpc/proto-loader@0.7.9

@grpc/reflection@1.*

@grpc/reflection@1.0.0

@grpc/reflection@1.0.1

@grpc/reflection@1.0.2

@grpc/reflection@1.0.3

@grpc/reflection@1.0.4

grpc-health-check@2.*

grpc-health-check@2.0.0

grpc-health-check@2.0.1

grpc-health-check@2.0.2

grpc-health-check@2.1.0

grpc-tool@1.*

grpc-tool@1.13.0

grpc-tools@1.*

grpc-tools@1.12.0

grpc-tools@1.12.1

grpc-tools@1.12.2

grpc-tools@1.12.3

grpc-tools@1.12.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48069.json"