chore(deps): update dependency @grpc/grpc-js to v1.14.5 [security] - #9506

Details

Impact

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.
2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Patches

This has been patched in versions 1.10.9, 1.9.15, and 1.8.22

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
• https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
• https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
• https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
• https://nvd.nist.gov/vuln/detail/CVE-2024-37168
• https://github.com/advisories/GHSA-7v5v-9h63-cj86

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @​grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-99f4-grh7-6pcq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @​grpc/grpc-js.

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-5375-pq7m-f5r2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.

Patches

This vulnerability is fixed in 1.13.6 and 1.14.5.

Workarounds

This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
• https://nvd.nist.gov/vuln/detail/CVE-2026-101915
• https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
• https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
• https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-f596-whhp-79r4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the result of getAuthContext for authentication.

In particular, @grpc/grpc-js-xds can both set the requireClientCertificate option to false and use the return value of getAuthContext for RBAC authentication in some configurations.

Patches

This vulenrability is fixed in 1.13.6 and 1.14.5.

Workarounds

@grpc/grpc-js users using getAuthContext this way can avoid this problem by setting requireClientCertificate to true. @grpc/grpc-js-xds users using RBAC can avoid this by setting the require_client_certificate field to true in the DownstreamTlsContext in the xDS configuration.

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
• https://nvd.nist.gov/vuln/detail/CVE-2026-101916
• https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
• https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-m9gg-hp2v-232j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v1.14.5: @​grpc/grpc-js 1.14.5

Compare Source

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
• Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
• Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#​3078)
• Fix a bug that could cause call status to be reported with expected fields missing (#​3079)
• Avoid redundant end() calls on completed HTTP/2 streams (#​3082 contributed by @​olavloite)
• Unify call numbers and avoid disabled trace allocations (#​3084 contributed by @​olavloite)