CVE-2026-48068
@grpc/grps-js: A malformed request can cause a server crash
Description
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
INFO
Published Date :
July 14, 2026, 8:17 p.m.
Last Modified :
July 14, 2026, 8:17 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-48068
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update @grpc/grpc-js to version 1.9.16 or later.
- Use version 1.10.12 or later.
- Use version 1.11.4 or later.
- Use version 1.12.7 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48068.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48068 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48068
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48068 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48068 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'grpc', 'product': 'grpc-node', 'versions': [{'status': 'affected', 'version': '< 1.9.16'}, {'status': 'affected', 'version': '>= 1.11.0, < 1.11.4'}, {'status': 'affected', 'version': '>= 1.12.0, < 1.12.7'}, {'status': 'affected', 'version': '>= 1.13.0, < 1.13.5'}, {'status': 'affected', 'version': '>= 1.14.0, < 1.14.4'}, {'status': 'affected', 'version': '>= 1.10.0, < 1.10.12'}]}] Added Description @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-248 Added Reference https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17 Added Reference https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7 Added Reference https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668 Added Reference https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba Added Reference https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903 Added Reference https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 Added Reference https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 Added Reference https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2