@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@grpc/grpc-js: A malformed request can cause a server crash

Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 Workarounds There is no workaround...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5324 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

Uncaught Exception

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Uncaught Exception through the handling of incoming compressed messages. An attacker can cause the process to crash by sending a malformed compressed message. Remediation Upgrade @grpc/grpc-js to...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +132 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentbadge/evm-core (0.1.1) +351 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.15, =0.1.9, =0.1.8, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.7.0 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5324 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 Workarounds There is no...

@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +129 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +129 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentbadge/evm-core (0.1.1) +351 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.15, =0.1.9, =0.1.8, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.7.0 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +132 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5324 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

GHSA-99F4-GRH7-6PCQ @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 Workarounds There is no...