@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Published 30 Sept 2026 · Updated 30 Sept 2026
Affected packages
- Affected
- <1.13.6
- Fixed in
- 1.13.6
npm install @grpc/grpc-js@1.13.6- Affected
- >=1.14.0 <1.14.5
- Fixed in
- 1.14.5
npm install @grpc/grpc-js@1.14.5Details
Impact
If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.
Patches
This vulnerability is fixed in 1.13.6 and 1.14.5.
Workarounds
This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.
Is GHSA-f596-whhp-79r4 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected @grpc/grpc-js, and gives you the command that fixes it.
References
- Linkgithub.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-101915
- Linkgithub.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
- Linkgithub.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
- Linkgithub.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
- Packagegithub.com/grpc/grpc-node
- Linkgithub.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
- Linkgithub.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.