Skip to main content

Uncaught Exception

CVE-2026-48068

High
7.5/10

Summary

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. Affected versions are prior to 1.9.16, 1.10.x prior to 1.10.12, 1.11.x prior to 1.11.4, 1.12.x prior to 1.12.7, 1.13.x prior to 1.13.5 and 1.14.x prior to 1.14.4.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published