Vulnerability record · CVE-2026-48068 · published 14 July 2026

CVE-2026-48068: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

7.5 CVSS 3.1 High EPSS 0.88% · top 42.5% CWE-248 · CWE-248 Awaiting Analysis

7.5CVSS 3.1 base score

0.88%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

13References

21 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Link	Tags
https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17
https://github.com/grpc/grpc-node/commit/1cf4bfa738b15e59cc3daf49ffa24c04f9b626f7
https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668
https://github.com/grpc/grpc-node/commit/455efce8acb7fb249652a74c1618a6d7daf1faba
https://github.com/grpc/grpc-node/commit/b1b7268f7b81b92c6f03f5128dfd871c08aeb903
https://github.com/grpc/grpc-node/commit/e2c035aab2fe5e55d46d5fc427481497314a53a4
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2

Track CVE-2026-48068 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-48068), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.