Is @grpc/grpc-js 1.9 vulnerable?
npm · 17 releases from 1.9.0 to 1.9.16 · latest @grpc/grpc-js is 1.14.7 · checked 1 Nov 2026
Yes: 2 known advisories
Yes. @grpc/grpc-js 1.9.16, the last 1.9 release, is affected by 2 known security advisories (1 high, 1 low), including CVE-2026-101916, CVE-2026-101915. 3 more affect earlier 1.9.x releases. Upgrade to 1.13.6 or later to fix all of them.
npm install @grpc/grpc-js@1.13.6Advisories affecting @grpc/grpc-js 1.9.16
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
- Affected
- <1.13.6 · >=1.14.0 <1.14.5
- Fixed in
- 1.13.6, 1.14.5
Fixed within 1.9.x, affecting earlier releases
@grpc/grpc-js: A malformed request can cause a server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
- Affected
- <1.9.16 · >=1.10.0 <1.10.12 · >=1.11.0 <1.11.4 · >=1.12.0 <1.12.7 · >=1.13.0 <1.13.5 · >=1.14.0 <1.14.4
- Fixed in
- 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
- Affected
- >=1.10.0 <1.10.9 · >=1.9.0 <1.9.15 · <1.8.22
- Fixed in
- 1.8.22, 1.9.15, 1.10.9
Which of your client projects are still on @grpc/grpc-js 1.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @grpc/grpc-js version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @grpc/grpc-js versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.