grpc vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20242
3. 20269

Newest CVEs

• CVE-2026-101916

  @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

  grpc · grpc-node

  High7.4
• CVE-2026-101915

  @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

  grpc · grpc-node

  Low3.7
• CVE-2026-101914

  @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

  grpc · grpc-node

  Medium6.5
• CVE-2026-84445

  gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

  grpc · grpc-go

  High8.7
• CVE-2026-84304

  gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

  grpc · grpc-go

  High8.7
• CVE-2026-84303

  gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

  grpc · grpc-go

  Medium6.3
• CVE-2026-48069

  @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

  grpc · grpc-node

  High7.5
• CVE-2026-48068

  @grpc/grps-js: A malformed request can cause a server crash

  grpc · grpc-node

  High7.5
• CVE-2026-33186

  gRPC-Go has an authorization bypass via missing leading slash in :path

  grpc · grpc-go

  Critical9.1
• CVE-2024-11407

  Denial of Service through Data corruption in gRPC-C++

  grpc · gRPC-C++

  Medium6.9