# @grpc/grpc-js (npm) vulnerabilities

6 known vulnerabilities (4 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 82.1M
- Dependents: 23.4K
- Registry: https://www.npmjs.com/package/@grpc/grpc-js

## Advisories (6)

### [CVE-2026-101916](https://cve.now/CVE-2026-101916): @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

- Severity: High 7.4
- Published: Sep 28, 2026
- Affected: fixed in 1.13.6; from 1.14.0, fixed in 1.14.5.

### [CVE-2026-101915](https://cve.now/CVE-2026-101915): @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

- Severity: Low 3.7
- Published: Sep 28, 2026
- Affected: fixed in 1.13.6; from 1.14.0, fixed in 1.14.5.

### [CVE-2026-48069](https://cve.now/CVE-2026-48069): @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

- Severity: High 7.5
- Published: Jul 14, 2026
- Affected: fixed in 1.9.16; from 1.10.0, fixed in 1.10.12; from 1.11.0, fixed in 1.11.4; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; from 1.14.0, fixed in 1.14.4.

### [CVE-2026-48068](https://cve.now/CVE-2026-48068): @grpc/grps-js: A malformed request can cause a server crash

- Severity: High 7.5
- Published: Jul 14, 2026
- Affected: fixed in 1.9.16; from 1.10.0, fixed in 1.10.12; from 1.11.0, fixed in 1.11.4; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; from 1.14.0, fixed in 1.14.4.

### [CVE-2024-37168](https://cve.now/CVE-2024-37168): @grpc/grpc-js can allocate memory for incoming messages well above configured limits

- Severity: Medium 5.3
- Published: Jun 10, 2024
- Affected: from 1.10.0, fixed in 1.10.9; from 1.9.0, fixed in 1.9.15; fixed in 1.8.22.

### [CVE-2020-7768](https://cve.now/CVE-2020-7768): Prototype Pollution

- Severity: High 7.5
- Published: Nov 11, 2020
- Affected: fixed in 1.1.8.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@grpc/grpc-js
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.