Vulnerability GHSA-f596-whhp-79r4
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
2 hours ago
September 30, 2026 at 03:35 PM UTC
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
0.1.0 - 1.13.5 and 1.14.0 - 1.14.4
0.1.0 - 1.13.5 and 1.14.0 - 1.14.4
Summary
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Details
Impact
If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.
Patches
This vulnerability is fixed in 1.13.6 and 1.14.5.
Workarounds
This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 hours ago
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
0.1.0 - 1.13.5 and 1.14.0 - 1.14.4 GHSA-m9gg-hp2v-232j
0.1.0 - 1.13.5 and 1.14.0 - 1.14.4 GHSA-m9gg-hp2v-232j
High Risk
3 months ago
@grpc/grpc-js: A malformed request can cause a server crash
0.1.0 - 1.9.15 and 1.10.0 - 1.10.11 and 1.11.0 - 1.11.3 and 1.12.0 - 1.12.6 and 1.13.0 - 1.13.4 and 1.14.0 - 1.14.3 GHSA-5375-pq7m-f5r2
0.1.0 - 1.9.15 and 1.10.0 - 1.10.11 and 1.11.0 - 1.11.3 and 1.12.0 - 1.12.6 and 1.13.0 - 1.13.4 and 1.14.0 - 1.14.3 GHSA-5375-pq7m-f5r2
High Risk
3 months ago
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
0.1.0 - 1.9.15 and 1.10.0 - 1.10.11 and 1.11.0 - 1.11.3 and 1.12.0 - 1.12.6 and 1.13.0 - 1.13.4 and 1.14.0 - 1.14.3 GHSA-99f4-grh7-6pcq
0.1.0 - 1.9.15 and 1.10.0 - 1.10.11 and 1.11.0 - 1.11.3 and 1.12.0 - 1.12.6 and 1.13.0 - 1.13.4 and 1.14.0 - 1.14.3 GHSA-99f4-grh7-6pcq
Medium Risk
2 years ago
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
0.1.0 - 1.8.21 and 1.9.0 - 1.9.14 and 1.10.0 - 1.10.8 GHSA-7v5v-9h63-cj86
0.1.0 - 1.8.21 and 1.9.0 - 1.9.14 and 1.10.0 - 1.10.8 GHSA-7v5v-9h63-cj86
High Risk
5 years ago
Prototype pollution in grpc and @grpc/grpc-js
0.1.0 - 1.1.7 GHSA-pp75-xfpw-37g9
0.1.0 - 1.1.7 GHSA-pp75-xfpw-37g9
Impacted packages
Timeline
Published
2 hours ago
September 30, 2026 at 03:35 PM UTC
Fixed (1.13.6)
Unknown
Unknown
Fixed (1.14.5)
Unknown
Unknown
Last Modified
2 hours ago
September 30, 2026 at 03:46 PM UTC