EUVD-2026-44409
GHSA-99f4-grh7-6pcq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Node.js service using @grpc/grpc-js
-
DeliveryEstablish gRPC connection to endpoint
-
ExploitSend frame with compressed flag and malformed payload
-
ExecutionTrigger uncaught exception in decompression path
-
PersistCrash Node.js process
-
ImpactSustained denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires the target process to use the @grpc/grpc-js library and to accept incoming gRPC messages with compression enabled, which is the default behavior of the library - no non-default configuration is needed. The attacker must be able to establish a gRPC connection to the victim (network reachability to the listening port for a server target, or the ability to host or impersonate a server that the victim client connects to). No authentication, user interaction, or prior access is required, but exploitation is limited to a denial-of-service outcome and bounded by network segmentation: services reachable only over mTLS-protected internal mesh links require an attacker positioned inside that trust boundary. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) accurately reflects an unauthenticated network-reachable availability-only impact, with no confidentiality or integrity consequences. There is no EPSS or CISA KEV signal provided in the input and no public exploit identified at time of analysis, so this is not currently a mass-exploitation priority; however, the trivial trigger (a single malformed compressed frame), the absence of any workaround, and the very broad deployment footprint of @grpc/grpc-js across Node.js microservices mean any internet-exposed gRPC endpoint should treat the patch as urgent. The risk is materially higher for public-facing gRPC services than for purely internal mesh traffic where the attack surface is bounded. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a gRPC endpoint exposed by a Node.js service using @grpc/grpc-js sends a single crafted gRPC message with the compressed-flag set and a malformed payload (for example, truncated or invalid gzip/deflate data). The uncaught exception during decompression terminates the Node.js worker, causing repeated crashes on each reconnection attempt and producing a sustained denial of service. The same primitive works in reverse against a vulnerable client connecting to a malicious or compromised server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Denial of service in the @grpc/grpc-js Node.js library allows remote attackers to crash any client or server process by sending an invalid compressed gRPC message. The flaw affects all versions prior to the fixed releases (1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4) and is exploitable over the network without authentication. No public exploit identified at time of analysis, and the vendor states there is no workaround other than upgrading.
RemediationAI
Vendor-released patch: upgrade @grpc/grpc-js to one of 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4 depending on the minor line currently in use, as published in the release notes at https://github.com/grpc/grpc-node/releases (e.g. tag @grpc/grpc-js@1.10.12). The maintainer explicitly states there is no workaround, so transitive dependencies must also be bumped - audit with npm ls @grpc/grpc-js and override pinned versions via npm overrides or yarn resolutions where direct upgrades are blocked. As compensating controls until patching completes, restrict gRPC endpoints to authenticated peers via mTLS so only trusted clients can send frames (trade-off: does not protect against compromised or malicious internal clients), and front public gRPC services with a proxy such as Envoy that performs gRPC frame validation before forwarding (trade-off: adds latency and operational complexity and may not catch every malformed compression payload). Disabling gRPC compression negotiation on the server side may reduce exposure if your application can tolerate the bandwidth cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@grpc/grpc-js is the pure-JavaScript implementation of gRPC for Node.js, distributed via the npm package @grpc/grpc-js and widely embedded in microservice frameworks and serverless backends. The vulnerability falls under CWE-248 (Uncaught Exception): the decompression code path for incoming gRPC messages does not handle malformed compressed payloads safely, allowing an unhandled exception to propagate and terminate the Node.js process. Because gRPC bidirectional streams permit either party to send compressed frames, both client and server roles instantiated from this library are equally exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable gRPC endpoint, single malformed frame triggers crash with no auth or interaction; impact is availability-only with no confidentiality or integrity loss.
Primary rating from Vendor (https://github.com/grpc/grpc-node).
CVSS VectorVendor: https://github.com/grpc/grpc-node
DescriptionCVE.org
Impact
An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js
Patches
The following version have fixes for this vulnerability:
- 1.9.16
- 1.10.12
- 1.11.4
- 1.12.7
- 1.13.5
- 1.14.4
Workarounds
There is no workaround.
Blast Radius
ecosystem impact- 17 npm packages depend on @grpc/grpc-js (11 direct, 6 indirect)
Ecosystem-wide dependent count for version 1.10.0.
Executive ViewAI
The @grpc/grpc-js Node.js library, critical infrastructure for inter-service communication in microservices architectures, contains a remotely exploitable denial-of-service vulnerability requiring no authentication. Any organization operating gRPC-based services faces immediate risk of application crashes and service outages, as attackers need only send a single malformed message over the network. With no known public exploitation to date but trivial attack complexity, urgent remediation is required to prevent widespread service disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB