The @grpc/grpc-js module implements a pure JavaScript version of the gRPC protocol, removing the need for a native C++ addon. In all releases prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, a malformed HTTP/2 stream initiation can cause the server process to crash. The crash terminates the server without corrupting data, but the service becomes unavailable until it is restarted, effectively providing a denial-of-service attack vector. The flaw is classified as CWE-248. The likely attack vector is a remote HTTP/2 request from an external entity containing a malformed stream initiation.

The offending code is contained in the @grpc/grpc-js module of the grpc:grpc-node package. Any Node.js application that relies on @grpc/grpc-js and is running a version older than 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4 is affected. Updating to any of the listed fixed releases eliminates the flaw.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% shows a low current exploitation probability. The issue is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP/2 request sent over the network; an attacker can trigger the crash by crafting a malformed stream initiation. Once exploited, the attack returns the server to a crashed state, which can be rectified only by restarting, resulting in a local denial of service.