CyberRota Analysis
AI-GeneratedThe @grpc/grpc-js library in JavaScript is vulnerable to a crash caused by processing an invalid incoming compressed message, affecting client and server processes. This high-severity issue can lead to service disruptions, making it critical for organizations using affected versions to upgrade to the patched releases (1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4) promptly. Developers and system administrators utilizing gRPC in their applications should prioritize this update to maintain service stability and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.