- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 4 high, 1 medium, 1 low
- Weekly downloads
- 82.1M
- Dependents
- 23.4K
- Registry
- npm
Advisories 6
- CVE-2026-101916High 7.4
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Affected: fixed in 1.13.6; from 1.14.0, fixed in 1.14.5.
- CVE-2026-101915Low 3.7
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Affected: fixed in 1.13.6; from 1.14.0, fixed in 1.14.5.
- CVE-2026-48069High 7.5
@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
Affected: fixed in 1.9.16; from 1.10.0, fixed in 1.10.12; from 1.11.0, fixed in 1.11.4; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; from 1.14.0, fixed in 1.14.4.
- CVE-2026-48068High 7.5
@grpc/grps-js: A malformed request can cause a server crash
Affected: fixed in 1.9.16; from 1.10.0, fixed in 1.10.12; from 1.11.0, fixed in 1.11.4; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; from 1.14.0, fixed in 1.14.4.
- CVE-2024-37168Medium 5.3
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected: from 1.10.0, fixed in 1.10.9; from 1.9.0, fixed in 1.9.15; fixed in 1.8.22.
- CVE-2020-7768High 7.5
Prototype Pollution
Affected: fixed in 1.1.8.