Low severity3.7NVD Advisory· Published Sep 28, 2026
CVE-2026-101915
CVE-2026-101915
Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffeanvd
- github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475fnvd
- github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0dnvd
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6nvd
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5nvd
- github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4nvd
News mentions
0No linked articles in our index yet.