Fluid Attacks Database

Description

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	@grpc/grpc-js	>=0 <1.9.16 \|\| >=1.10.0 <1.10.12 \|\| >=1.11.0 <1.11.4 \|\| >=1.12.0 <1.12.7 \|\| >=1.13.0 <1.13.5 \|\| >=1.14.0 <1.14.4	1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
rpm rhel10	rh-podman-desktop	<0:1.1.2-1.el10_2	0:1.1.2-1.el10_2

Aliases

1. CVE-2026-480682. NVD-2026-480683. OSV-2026-480684. GHSA-5375-pq7m-f5r25. GCVE-2026-48068

References

1. https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r22. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.123. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.44. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.75. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.56. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.47. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.