HIGH7.5

GHSA-5375-pq7m-f5r2

@grpc/grpc-js: A malformed request can cause a server crash

Quick fix

GHSA-5375-pq7m-f5r2 — @grpc/grpc-js: upgrade to the fixed version with the command below.

npm install @grpc/grpc-js@1.9.16

Details

### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.

### Patches The following version have fixes for this vulnerability:

- 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4

### Workarounds There is no workaround.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 1.9.16

Fixnpm install @grpc/grpc-js@1.9.16

Introduced in: 1.10.0Fixed in: 1.10.12

Fixnpm install @grpc/grpc-js@1.10.12

Introduced in: 1.11.0Fixed in: 1.11.4

Fixnpm install @grpc/grpc-js@1.11.4

Introduced in: 1.12.0Fixed in: 1.12.7

Fixnpm install @grpc/grpc-js@1.12.7

Introduced in: 1.13.0Fixed in: 1.13.5

Fixnpm install @grpc/grpc-js@1.13.5

Introduced in: 1.14.0Fixed in: 1.14.4

Fixnpm install @grpc/grpc-js@1.14.4