原始 OSV JSON
{
"id": "GHSA-99f4-grh7-6pcq",
"aliases": [
"CVE-2026-48069"
],
"details": "### Impact\nAn invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js\n\n### Patches\nThe following version have fixes for this vulnerability:\n\n - 1.9.16\n - 1.10.12\n - 1.11.4\n - 1.12.7\n - 1.13.5\n - 1.14.4\n\n### Workarounds\nThere is no workaround.",
"summary": "@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.16"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.10.12"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.11.0"
},
{
"fixed": "1.11.4"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.7"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.5"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.4"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"ecosystem": "npm"
}
}
],
"modified": "2026-06-11T13:27:44Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2026-06-11T13:27:44Z",
"references": [
{
"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node",
"type": "PACKAGE"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4",
"type": "WEB"
},
{
"url": "https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-06-11T13:27:44Z"
}
}