Is @grpc/grpc-js 1.14 vulnerable?
npm · 8 releases from 1.14.0 to 1.14.7 · latest @grpc/grpc-js is 1.14.7 · checked 1 Nov 2026
No known advisories in the last release
@grpc/grpc-js 1.14.7, the last 1.14 release, has no known advisories. 4 advisories affect earlier 1.14.x releases, so update to 1.14.7.
npm install @grpc/grpc-js@1.14.7Fixed within 1.14.x, affecting earlier releases
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
@grpc/grpc-js: A malformed request can cause a server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
Which of your client projects are still on @grpc/grpc-js 1.14?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @grpc/grpc-js version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @grpc/grpc-js versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.