GHSA-5375-pq7m-f5r2
@grpc/grpc-js: A malformed request can cause a server crash
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-48068
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 ### Workarounds There is no workaround.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · @grpc/grpc-js | introduced 0, fixed 1.9.16 |
| npm · @grpc/grpc-js | introduced 1.10.0, fixed 1.10.12 |
| npm · @grpc/grpc-js | introduced 1.11.0, fixed 1.11.4 |
| npm · @grpc/grpc-js | introduced 1.12.0, fixed 1.12.7 |
| npm · @grpc/grpc-js | introduced 1.13.0, fixed 1.13.5 |
| npm · @grpc/grpc-js | introduced 1.14.0, fixed 1.14.4 |
Références
- https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2 WEB
- https://github.com/grpc/grpc-node PACKAGE
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 WEB
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 WEB
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 WEB
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 WEB
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 WEB
- https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |