logo

Database

Asymmetric denial of service - ReDoS In @grpc/grpc-js

Description

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

    1.9.16

    1.10.12

    1.11.4

    1.12.7

    1.13.5

    1.14.4

Workarounds

There is no workaround.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-480692. NVD-2026-480693. OSV-2026-480694. GHSA-99f4-grh7-6pcq5. GCVE-2026-48069

References

1. https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq2. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.123. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.44. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.75. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.56. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.47. https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.