Is @grpc/grpc-js 1.12 vulnerable?
npm · 8 releases from 1.12.0 to 1.12.7 · latest @grpc/grpc-js is 1.14.7 · checked 1 Nov 2026
Yes: 2 known advisories
Yes. @grpc/grpc-js 1.12.7, the last 1.12 release, is affected by 2 known security advisories (1 high, 1 low), including CVE-2026-101916, CVE-2026-101915. 2 more affect earlier 1.12.x releases. Upgrade to 1.13.6 or later to fix all of them.
npm install @grpc/grpc-js@1.13.6Advisories affecting @grpc/grpc-js 1.12.7
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
Fixed within 1.12.x, affecting earlier releases
@grpc/grpc-js: A malformed request can cause a server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
Which of your client projects are still on @grpc/grpc-js 1.12?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @grpc/grpc-js version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @grpc/grpc-js versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.