7.5

CVE-2026-48068: grpc grpc-node Uncaught Exception

CVSS: 7.5v3.1HighAwaiting analysis
AliasesCGA-3r7v-9vw2-87g2CGA-f47v-rgxf-59r7CGA-f7f8-2xgf-483m
Published 14-07-2026Last modified 21-07-2026
Open JSON

Vulnerability summary

CVE-2026-48068 is a high (CVSS 7.5) Uncaught Exception vulnerability in grpc grpc-node. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.88%
0%100%
Low · +0.26 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
RHSA-2026:57590CGA-R78V-2M6W-5437

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 21-07-2026
    Last modifiedVulnerability information updated.

Description

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.88%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

+0.26 pp

From 0.62% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.88%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard31 products
  • cadence-web< 4.0.15-r3
  • gemini-cli< 0.49.0-r2
  • jitsucom-jitsu-console< 2.11.0-r27
  • kibana-8.17< 8.17.10-r24
  • kibana-8.17-bitnami< 8.17.10-r24
Wolfi5 products
  • jitsucom-jitsu-console< 2.11.0-r27
  • langfuse-3< 3.186.0-r0
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.186.0-r0
  • pulumi-language-nodejs< 3.246.0-r1
@grpc1 product
  • grpc-js< 1.9.16 | ≥ 1.10.0, < 1.10.12 | ≥ 1.11.0, < 1.11.4 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.5 | ≥ 1.14.0, < 1.14.4
Grpc1 product
  • grpc-node< 1.9.16 | ≥ 1.11.0, < 1.11.4 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.5 | ≥ 1.14.0, < 1.14.4 | ≥ 1.10.0, < 1.10.12

4 vendors · 38 products

References

16 links
Show all 16 references