CVE-2026-48068: @grpc/grpc-js DoS Vulnerability

CVE-2026-48068 Overview

CVE-2026-48068 is a denial-of-service vulnerability affecting @grpc/grpc-js, the pure-JavaScript implementation of gRPC used widely in Node.js server applications. An unauthenticated remote attacker can initiate an invalid HTTP/2 stream against a gRPC server, causing the Node.js process to crash. The flaw is tracked under [CWE-248: Uncaught Exception] and stems from a missing error handler on incoming HTTP/2 streams. The issue is fixed in @grpc/grpc-js versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Critical Impact
Any network-reachable gRPC server built on vulnerable versions of @grpc/grpc-js can be crashed by an unauthenticated attacker sending a malformed HTTP/2 stream, resulting in service outage.

Affected Products

@grpc/grpc-js versions prior to 1.9.16 (1.9.x branch)
@grpc/grpc-js versions prior to 1.10.12, 1.11.4, and 1.12.7
@grpc/grpc-js versions prior to 1.13.5 and 1.14.4

Discovery Timeline

2026-07-14 - CVE-2026-48068 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48068

Vulnerability Analysis

The @grpc/grpc-js package implements gRPC entirely in JavaScript on top of Node.js's built-in http2 module. When a client opens a new HTTP/2 stream to a gRPC server, the server registers callbacks to process headers, data, and stream lifecycle events. If the stream transitions to an error state before those handlers are registered, Node.js emits an error event with no listener attached.

An unhandled error event in Node.js is promoted to an uncaught exception, which terminates the process. An attacker sending a crafted or malformed HTTP/2 HEADERS frame that triggers a stream-level error can therefore crash the entire server. No authentication or user interaction is required, and the attack is delivered over the network.

Root Cause

The root cause is a missing error event listener on the ServerHttp2Stream object at the moment the server receives a new stream. The server logic assumed every stream would remain healthy long enough to reach the request-handling path, where an error handler was later attached inside the ServerCall constructor. Invalid stream initiations short-circuit that path, leaving the emitted error uncaught.

Attack Vector

Exploitation requires only network reachability to the gRPC server's HTTP/2 listener. An attacker opens a TCP/TLS connection, performs the HTTP/2 preface, and initiates a stream whose framing or headers cause http2 to emit a stream-level error prior to full request processing. Repeating the request from a single source is enough to keep the service offline.

typescript

// Patch: attach error handler at stream ingress in packages/grpc-js/src/server.ts
    stream: http2.ServerHttp2Stream,
    headers: http2.IncomingHttpHeaders
  ) {
+    stream.once('error', (err: ServerErrorResponse) => {
+      /* We need an error handler to avoid uncaught error event exceptions, but
+       * there is nothing we can reasonably do here. Any error event should
+       * have a corresponding close event, which handles emitting the cancelled
+       * event. And the stream is now in a bad state, so we can't reasonably
+       * expect to be able to send an error over it. */
+    });
    // for handling idle timeout
    this.onStreamOpened(stream);
// Source: https://github.com/grpc/grpc-node/commit/058665a6c6dae445e2ab0f3f6259164fac52ee17

The fix moves the error listener registration from ServerCall (in server-call.ts) up to the stream ingress point in server.ts, ensuring the listener is attached before any error can be emitted. See gRPC Security Advisory GHSA-5375-pq7m-f5r2 for full details.

Detection Methods for CVE-2026-48068

Indicators of Compromise

Unexpected termination of Node.js gRPC server processes with stack traces referencing Http2Streamerror events or emitUnhandledRejectionOrErr.
Repeated short-lived HTTP/2 connections from a single source immediately followed by service restarts or container exits.
Elevated RST_STREAM or GOAWAY frame counts in HTTP/2 telemetry preceding a crash.

Detection Strategies

Inventory Node.js applications and enumerate installed @grpc/grpc-js versions using npm ls @grpc/grpc-js or SBOM tooling; flag any version below the fixed releases.
Monitor process supervisors (systemd, PM2, Kubernetes) for crash-loop patterns on gRPC workloads and correlate with inbound HTTP/2 traffic spikes.
Enable Node.js --unhandled-rejections=strict logging and centralize stderr output so uncaught HTTP/2 stream errors are captured for triage.

Monitoring Recommendations

Alert on gRPC server pod restarts exceeding baseline in orchestration platforms such as Kubernetes.
Track HTTP/2 stream error rates at the ingress or service mesh layer (Envoy, NGINX, Istio) and alert on anomalous stream-error bursts from single peers.
Ingest application and container logs into a centralized analytics platform to correlate crash events with source IPs and request patterns.

How to Mitigate CVE-2026-48068

Immediate Actions Required

Upgrade @grpc/grpc-js to a patched release matching your minor version: 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4.
Rebuild and redeploy all Node.js services that transitively depend on @grpc/grpc-js, including sidecars and internal tooling.
Restrict inbound access to gRPC endpoints to trusted networks or authenticated peers until patching is complete.

Patch Information

The gRPC Node maintainers released fixes across six supported branches. Reference the release notes and commits: gRPC Node Release v1.9.16, v1.10.12, v1.11.4, v1.12.7, v1.13.5, and v1.14.4. The corresponding source fix is in commit 058665a.

Workarounds

Place gRPC servers behind an HTTP/2-aware reverse proxy or service mesh that validates and terminates malformed streams before they reach the Node.js process.
Deploy gRPC workloads with an automatic restart supervisor (Kubernetes, systemd, PM2) to minimize downtime from crash-induced outages until patches land.
Apply rate limiting and IP-based access controls at ingress to reduce the blast radius of repeated crash attempts from a single source.

bash

# Upgrade @grpc/grpc-js to a patched version and verify
npm install @grpc/grpc-js@1.14.4
npm ls @grpc/grpc-js

# Or pin the fix in package.json, then reinstall
#   "@grpc/grpc-js": "^1.14.4"
npm ci