All vulnerabilities
CVE-2026-101915GHSA-f596-whhp-79r4

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

grpc @grpc/grpc-jsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
3.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.13.6Also 1.14.5GitHub
Published28 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 1.13.6@grpc/grpc-js, npmGitHubnpm install @grpc/grpc-js@1.13.6
  • 1.14.5@grpc/grpc-js, npmGitHubnpm install @grpc/grpc-js@1.14.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.

Patches

This vulnerability is fixed in 1.13.6 and 1.14.5.

Workarounds

This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.

Text from GitHub Advisory Database

Affected versions 6

  • @grpc/grpc-js, npm< 1.13.6GitHub
  • @grpc/grpc-js, npm>= 1.14.0, < 1.14.5GitHub
  • grpc-nodeaffected: < 1.13.6CVE List
  • grpc-nodeaffected: >= 1.14.0, < 1.14.5CVE List
  • @grpc/grpc-js, npmfrom first release, fixed in 1.13.6OSV
  • @grpc/grpc-js, npmfrom 1.14.0, fixed in 1.14.5OSV

References 8