CVE-2026-101915: @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.
References
- github.com/advisories/GHSA-f596-whhp-79r4
- github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
- github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
- github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
- github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
- nvd.nist.gov/vuln/detail/CVE-2026-101915
Code Behaviors & Features
Detect and mitigate CVE-2026-101915 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →