{"schemaVersion":3,"id":"CVE-2026-101915","aliases":["CGA-243q-fx62-984w","CGA-6v9p-3866-7h8p","CGA-862g-33fr-gm2g","CGA-cr3v-3q3x-cmvr","CGA-fc3h-p4vm-68h6","CGA-fg82-jfg3-3448","CGA-qqpj-4w5m-h8g5","CGA-rgxw-63fq-82h3","GHSA-f596-whhp-79r4","CGA-2wm7-w2vf-862h","CGA-3ccp-mfgr-w2g2","CGA-5777-84jv-x3mx","CGA-599j-r3p9-7mg8","CGA-62fm-7chp-5fqj","CGA-74wr-8wc2-88c5","CGA-7v25-w32v-fh86","CGA-824w-8vw3-fw7h","CGA-9crw-q3fw-8q27","CGA-c52v-fjh3-6rj4","CGA-cvjm-f6p4-849v","CGA-cxj7-2f45-w9xq","CGA-ggw3-gmq2-4fvv","CGA-gvpg-v2c2-74qj","CGA-h8m9-m5qv-v6hc","CGA-hwjg-5x3h-3fhj","CGA-mfgg-v8h5-755x","CGA-mgp9-jvc7-g8h5","CGA-mrx3-4hm4-wvvj","CGA-pghq-2p6q-cc8q","CGA-pqc8-f3f4-c9hw","CGA-pqjv-qgv7-69q9","CGA-rj86-64fc-j89g","CGA-v4px-c5jx-49g7","CGA-wm68-35v6-69pc","CGA-wm6w-jpr6-r53w","CGA-x35g-w25p-qg2w","CGA-x3f3-x5rf-c3r3"],"status":"published","duplicateOf":null,"title":null,"description":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.","dates":{"published":"2026-09-28T19:48:09.860Z","modified":"2026-10-01T14:53:47.117Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.7,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00251,"percentile":0.1541,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-29T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00251,"percentile":0.1541}],"last30":[{"date":"2026-09-29T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00251,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00251,"percentile":0.1541}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-550","name":"Server-generated Error Message Containing Sensitive Information","description":"Certain conditions, such as network failure, will cause a server error message to be displayed.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/550.html"}],"affected":[{"vendor":"chainguard","product":"azurite","name":"azurite","label":"azurite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/azurite","purlType":"apk","versions":[{"text":"< 3.37.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.37.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.17-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.17-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotstatsuite-supercore","name":"dotstatsuite-supercore","label":"dotstatsuite-supercore","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotstatsuite-supercore","purlType":"apk","versions":[{"text":"< 3.1.0_git20261001-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0_git20261001-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 2.4.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.22-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.22-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.22-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.22-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.225.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4 | < 3.225.11-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.225.11-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentelemetry-auto-instrumentations-node","name":"opentelemetry-auto-instrumentations-node","label":"opentelemetry-auto-instrumentations-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentelemetry-auto-instrumentations-node","purlType":"apk","versions":[{"text":"< 0.80.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.80.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.268.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.268.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zitadel-4-login","name":"zitadel-4-login","label":"zitadel-4-login","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zitadel-4-login","purlType":"apk","versions":[{"text":"< 4.19.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.19.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.225.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4 | < 3.225.11-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.268.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.268.0-r0","eol":null,"hubHref":null},{"vendor":"grpc","product":"grpc-node","name":"grpc-node","label":"grpc-node","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.14.0, < 1.14.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.6 | ≥ 1.14.0, < 1.14.5","eol":null,"hubHref":"/vendor/grpc/grpc-node"},{"vendor":"@grpc","product":"grpc-js","name":"@grpc/grpc-js","label":"grpc-js","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@grpc/grpc-js","purlType":"npm","versions":[{"text":"< 1.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.14.0, < 1.14.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.6 | ≥ 1.14.0, < 1.14.5","eol":null,"hubHref":null}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4","label":"github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea","label":"github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f","label":"github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d","label":"github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6","label":"github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5","label":"github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101915.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101915.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101915","label":"nvd.nist.gov/vuln/detail/CVE-2026-101915","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/grpc/grpc-node","label":"github.com/grpc/grpc-node","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-28T19:48:09.860Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-01T14:53:47.117Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":15,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T03:45:57.408Z","stale":false,"partial":false}}