The vulnerability arises when a gRPC method handler throws an uncaught error, causing the grpc‑js server to embed the raw error message in the status sent back to the client. This behavior can reveal confidential information that was contained in the error message, leading to sensitive data disclosure. The weakness is classified as restricted data access (CWE‑550).

Affected products include the grpc/grpc‑node JavaScript implementation of gRPC. Versions before 1.13.6 and before 1.14.5 are susceptible. Users of any server built with these library versions should consider upgrading.

The score of 3.7 on the CVSS scale indicates moderate severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Although exploitation is possible through client‑initiated requests that trigger unhandled exceptions, the attacker is limited to learning error messages returned by the server. The attack is likely remote, leveraging the gRPC network interface, but does not grant code execution or privilege escalation.