7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48069

CVE-2026-48069: @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

1.9.16
1.10.12
1.11.4
1.12.7
1.13.5
1.14.4

Workarounds

There is no workaround.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48069

CVE-2026-48069:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@grpc/grpc-js	npm	< 1.9.16	1.9.16
@grpc/grpc-js	npm	>= 1.10.0, < 1.10.12	1.10.12
@grpc/grpc-js	npm	>= 1.11.0, < 1.11.4	1.11.4
@grpc/grpc-js	npm	>= 1.12.0, < 1.12.7	1.12.7
@grpc/grpc-js	npm	>= 1.13.0, < 1.13.5	1.13.5
@grpc/grpc-js	npm	>= 1.14.0, < 1.14.4	1.14.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

I have analyzed the vulnerability GHSA-99f4-grh7-6pcq in @grpc/grpc-js. The vulnerability lies in the handling of malformed compressed messages, which can lead to a client or server crash.

The investigation of the provided reference URLs and the grpc/grpc-node repository led me to the commits that patch this vulnerability. The fix involves adding a check to ensure that the decompressed message size is not zero. If it is, an error is thrown, preventing the application from crashing.

The vulnerable function is http2.onData, which is an event handler for incoming data chunks. Inside this handler, the code attempts to decompress the message. The vulnerability is triggered when a malformed compressed message results in a zero-length buffer after decompression, which was not handled correctly, leading to a crash.

The patch was applied in multiple branches, and I have identified the relevant commits. For example, in the 1.9.x branch, the fix is in commit c5355957479009126b1342b382833c44a61b1c3a. The key change is in the http2.ts file, where a check for the decompressed message length is added.

Vulnerable functions

http2.onData

packages/grpc-js/src/http2.ts

The vulnerability is in the `http2.onData` function, which handles incoming data chunks. A malformed compressed message can result in a zero-length buffer after decompression. The original code did not handle this case, leading to a crash. The patch adds a check to ensure the decompressed message length is not zero.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.