CyberRota Analysis
AI-GeneratedApplications using the @grpc/grpc-js library prior to versions 1.13.6 and 1.14.5 are vulnerable to sensitive information disclosure due to uncaught errors being transmitted to clients in error messages. This could potentially expose sensitive data if error messages contain confidential information. Developers and organizations utilizing this library should prioritize updating to the fixed versions to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.