HTTP/2 Stream Initiation Issue in gRPC JavaScript Implementation by Google
CVE-2026-48068
7.5HIGH
What is CVE-2026-48068?
The gRPC library implemented in JavaScript, specifically @grpc/grpc-js, has a vulnerability that arises from how it handles incoming HTTP/2 stream initiations. Prior to specific updates, an invalid stream initiation could lead to a crash of the server process. This vulnerability has been addressed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. It is important for developers using this library to ensure they are running an updated version to protect against potential denial of service attacks caused by malformed HTTP/2 streams.
Affected Version(s)
grpc-node < 1.9.16 < 1.9.16
grpc-node >= 1.11.0, < 1.11.4 < 1.11.0, 1.11.4
grpc-node >= 1.12.0, < 1.12.7 < 1.12.0, 1.12.7