Technical impact
The @grpc/grpc-js module implements a pure JavaScript version of the gRPC protocol, removing the need for a native C++ addon. In all releases prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, a malformed HTTP/2 stream initiation can cause the server process to crash. The crash terminates the server without corrupting data, but the service becomes unavailable until it is restarted, effectively providing a denial-of-service attack vector. The flaw is classified as CWE-248. The likely attack vector is a remote HTTP/2 request from an external entity containing a malformed stream initiation.
Affected Systems
The offending code is contained in the @grpc/grpc-js module of the grpc:grpc-node package. Any Node.js application that relies on @grpc/grpc-js and is running a version older than 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4 is affected. Updating to any of the listed fixed releases eliminates the flaw.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% shows a low current exploitation probability. The issue is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP/2 request sent over the network; an attacker can trigger the crash by crafting a malformed stream initiation. Once exploited, the attack returns the server to a crashed state, which can be rectified only by restarting, resulting in a local denial of service.
Github GHSA