EUVD-2026-44405
GHSA-5375-pq7m-f5r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed gRPC endpoint
-
DeliveryCraft malformed HTTP/2 stream init frame
-
ExploitSend frame to server
-
ExecutionTrigger uncaught exception in stream handler
-
PersistNode.js process crashes
-
ImpactRepeat to sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any Node.js application that uses @grpc/grpc-js to expose a gRPC server on a network-reachable port. The attacker only needs TCP reachability to the gRPC listener and the ability to send a malformed HTTP/2 stream initiation frame; no TLS client certificate, gRPC credential, or application-level authentication is required because the crash occurs during HTTP/2 stream setup, before any application authentication runs. The principal limiting factor is network exposure: gRPC servers bound only to localhost or restricted to trusted networks by firewall/service mesh policy are not reachable by external attackers, though they remain exposed to any lateral attacker inside that perimeter. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) accurately reflects the real-world risk: a single unauthenticated packet over the network reliably crashes the server with no user interaction, but with no impact on confidentiality or integrity - it is a pure availability/DoS issue. EPSS and KEV data are not provided, and no public exploit is identified at the time of analysis, but exploitation is trivial for anyone who can construct a malformed HTTP/2 stream init frame and reach the gRPC port, so the bar to weaponization is low. The vendor explicitly states there is no workaround, which elevates priority: any internet-exposed gRPC server is one packet away from a crash loop until patched, and even internal-only services are exposed to compromised neighbors on the same network. |
| Exploit ScenarioDerived | An attacker who can reach a gRPC endpoint exposed by a Node.js service - for example a public-facing API gateway, an internal microservice reachable from a compromised pod, or a developer-exposed port - sends a single crafted HTTP/2 frame that initiates an invalid stream. The @grpc/grpc-js server raises an uncaught exception, the Node process terminates, and every in-flight RPC on that instance fails; repeating the request in a loop keeps the service permanently down until patched. No authentication, user interaction, or prior foothold is required, and no public exploit is identified at time of analysis though the technique is straightforward to reconstruct from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Remote denial of service in @grpc/grpc-js (the official gRPC library for Node.js) allows unauthenticated network attackers to crash any server process by sending a malformed HTTP/2 stream initiation frame. The flaw stems from an uncaught exception (CWE-248) triggered during stream setup, affecting all server applications built on this widely-used npm package across multiple release branches (1.9.x through 1.14.x). No public exploit identified at time of analysis, but the trivial attack complexity and absence of any workaround make patching the only mitigation.
RemediationAI
Vendor-released patches are available; upgrade @grpc/grpc-js to one of the fixed versions appropriate to your release branch: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4 (see release notes such as https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 and the advisory at https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2). The maintainers explicitly state there is no workaround, so patching is mandatory; as compensating controls until the upgrade can be rolled out, restrict network reachability of gRPC ports (typically 50051 or whatever ports your services bind) to known client CIDRs via firewall or service mesh policy, place the server behind an HTTP/2-aware reverse proxy or API gateway that validates stream initiation frames before forwarding, and ensure a process supervisor (systemd, Kubernetes liveness probe, PM2) immediately restarts the Node process on crash to limit downtime - accepting that this still leaves a trivially-triggered DoS window with each malformed packet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The @grpc/grpc-js package is the pure-JavaScript implementation of gRPC for Node.js, distributed via npm as @grpc/grpc-js and used by a large portion of the Node ecosystem for microservice RPC. gRPC layers on top of HTTP/2, and this vulnerability lives in the server-side HTTP/2 stream initiation path: when an invalid frame opens a new stream, the resulting error propagates uncaught and terminates the Node.js process. This is a textbook CWE-248 (Uncaught Exception) issue, which in Node is especially severe because an unhandled exception in an HTTP/2 callback bypasses normal request-scoped error handling and crashes the entire event loop, taking down every concurrent connection on that server.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote network reach, low complexity, no auth or user interaction needed; impact is process crash so availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (https://github.com/grpc/grpc-node).
CVSS VectorVendor: https://github.com/grpc/grpc-node
DescriptionCVE.org
Impact
An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.
Patches
The following version have fixes for this vulnerability:
- 1.9.16
- 1.10.12
- 1.11.4
- 1.12.7
- 1.13.5
- 1.14.4
Workarounds
There is no workaround.
Blast Radius
ecosystem impact- 17 npm packages depend on @grpc/grpc-js (11 direct, 6 indirect)
Ecosystem-wide dependent count for version 1.10.0.
Executive ViewAI
@grpc/grpc-js (Node.js gRPC library) versions 1.9.x through 1.14.x contain a remote denial-of-service vulnerability allowing unauthenticated attackers to crash application servers with malformed HTTP/2 frames. Without an available patch or documented workarounds, organizations face immediate service availability risk across all affected gRPC deployments.
No vendor-released patch identified at time of analysis. Standard network-level mitigations do not address root cause; patch deployment is the primary remediation once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB