An invalid incoming compressed message causes the @grpc/grpc-js library to crash, terminating client or server processes. The library is implemented purely in JavaScript, without any C++ native addon. The vulnerability is present in versions released before 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, and is fixed in those versions and later. This can be leveraged to perform a denial‑of‑service attack, disrupting service availability without compromising confidentiality or integrity. The weakness is identified as unchecked untrusted input.

The vulnerability affects the grpc:grpc-node package, specifically versions released before 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. Updates to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4 and later releases contain the fix.

The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by sending a crafted compressed message over the network, making the attack vector likely remote and network‑based. While the likelihood of exploitation is low, the high impact warrants prompt remediation.