@a11ywatch/core (>=0.8.13, <=0.8.15), @a11ywatch/mav (>=0.7.17, <=0.7.27) +91 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.9.0, <=1.9.14)

@grpc/grpc-js NPM version =1.9.0, =0.8.13, =0.7.17, =0.9.42, =3.1.3, =0.61.0, =1.61.0, =0.2.2, =0.1.1, =0.0.5, =0.0.6, =0.0.8, =0.0.11, =0.0.5, =1.0.1, =7.1.3 and more Source cves: CVE-2024-37168 Source advisory: OSV:GHSA-7V5V-9H63-CJ86...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +82 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.10.0, <=1.10.8)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =3.1.9, =0.78.0, =1.68.0, =8.5.1-alpha.4, =3.5.2, =17.8.3, =0.0.1-hw-fix-code-nightly-gha.29105, =0.1.5-hw-fix-code-nightly-gha.29105, =0.1.5-pd-ent-755-gha.29158 and more Source cves: CVE-2024-37168 Source advisory:...

CVE-2024-37168 @grpc/grpc-js can allocate memory for incoming messages well above configured limits

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: If an...

CVE-2024-37168

CVE-2024-37168 affects @grpc/grpc-js (pure JavaScript implementation of gRPC). Before the fixes, two code paths could buffer or decompress messages that exceed grpc.max_receive_message_length, potentially causing memory allocation in excess of the limit. This could occur when a message arrives la...

Prototype Pollution

Overview "The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition." Recommendation Upgrade to version 1.1.8 or later References - CVE - GitHub Advisory...

Prototype pollution in grpc and @grpc/grpc-js

"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."...

@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)

@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

Design/Logic Flaw

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768 Prototype Pollution

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768: Improperly Controlled Modification of Object Prototype Attributes

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

PT-2020-19780 · Grpc · Grpc +1

Name of the Vulnerable Software and Affected Versions: grpc versions prior to 1.24.4 @grpc/grpc-js versions prior to 1.1.8 Description: The issue concerns Prototype Pollution via loadPackageDefinition. This affects the grpc and @grpc/grpc-js packages. Recommendations: For grpc versions prior to...

@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)

@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...