@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior
    to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated
    per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has
    a size on the wire greater than the configured limit, the entire message is buffered before it is
    discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a
    size greater than the limit, the entire message is decompressed into memory, and on the server is not
    discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22. (CVE-2024-37168)

ID	Name	Product	Family	Type	Severity
473536	Echo: @grpc/grpc-js: security update to 1.8.22	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473536	Echo: @grpc/grpc-js: security update to 1.8.22	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
412267	SCA: security update for @grpc/grpc-js (GHSA-7v5v-9h63-cj86)	Tenable Cloud Security	SCA Checks	Local	medium
412267	SCA: security update for @grpc/grpc-js (GHSA-7v5v-9h63-cj86)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-37168

medium

Tenable Plugins

medium

medium

medium

medium