7.5

CVE-2026-48069: grpc grpc-node Uncaught Exception

CVSS: 7.5v3.1HighDeferred
AliasesCGA-642x-cv4r-7887CGA-7rvj-hq58-6934CGA-c4jv-4qf3-qgjp
Published 14-07-2026Last modified 15-07-2026
Open JSON

Vulnerability summary

CVE-2026-48069 is a high (CVSS 7.5) Uncaught Exception vulnerability in grpc grpc-node. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.88%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-W7P7-2RQ5-8X24

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.88%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

0.00 pp

From 0.88% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.88%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard31 products
  • cadence-web< 4.0.15-r3
  • gemini-cli< 0.49.0-r2
  • jitsucom-jitsu-console< 2.11.0-r27
  • kibana-8.17< 8.17.10-r24
  • kibana-8.17-bitnami< 8.17.10-r24
Wolfi5 products
  • jitsucom-jitsu-console< 2.11.0-r27
  • langfuse-3< 3.186.0-r0
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.186.0-r0
  • pulumi-language-nodejs< 3.246.0-r1
@grpc1 product
  • grpc-js< 1.9.16 | ≥ 1.10.0, < 1.10.12 | ≥ 1.11.0, < 1.11.4 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.5 | ≥ 1.14.0, < 1.14.4
Grpc1 product
  • grpc-node< 1.9.16 | ≥ 1.10.0, < 1.10.12 | ≥ 1.11.0, < 1.11.4 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.5 | ≥ 1.14.0, < 1.14.4

4 vendors · 38 products

References

16 links
Show all 16 references