grpc grpc-node vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20265

Newest CVEs

• CVE-2026-101916

  @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

  grpc · grpc-node

  High7.4
• CVE-2026-101915

  @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

  grpc · grpc-node

  Low3.7
• CVE-2026-101914

  @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

  grpc · grpc-node

  Medium6.5
• CVE-2026-48069

  @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

  grpc · grpc-node

  High7.5
• CVE-2026-48068

  @grpc/grps-js: A malformed request can cause a server crash

  grpc · grpc-node

  High7.5
• CVE-2024-37168

  @grpc/grpc-js can allocate memory for incoming messages well above configured limits

  grpc · grpc-node

  Medium5.3