AIKIDO-2026-176083
@grpc/grpc-js is vulnerable to Information Disclosure
37
CVE Score
Low
Information Disclosure
TL;DR
When an application method handler throws inside @grpc/grpc-js, the server includes the thrown error's message text in the gRPC status details sent back to the client. Any sensitive data an application puts in an exception message is exposed to remote callers by default. The patch replaces the forwarded message with a generic Unknown error detail and only sends the original message when the new GRPC_NODE_DEBUG_SEND_ERROR_DETAILS environment variable is enabled.
How do I fix this?
Upgrade the @grpc/grpc-js library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a method handler in your service can throw an error whose message contains sensitive information.
Package
Versions
0.0.1 - 1.13.5
Fixed in 1.13.61.14.0 - 1.14.4
Fixed in 1.14.5Background info
@grpc/grpc-js is vulnerable to Information Disclosure in versions 0.0.1 - 1.13.5 and 1.14.0 - 1.14.4.
Links
GitHub Releases
github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.13.6github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5Fix Commits
github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffeagithub.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475fgithub.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.