{"id":"CVE-2026-101915","summary":"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages","details":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.","aliases":["GHSA-f596-whhp-79r4"],"modified":"2026-09-30T03:47:03.852625114Z","published":"2026-09-28T19:48:09.860Z","database_specific":{"cwe_ids":["CWE-550"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101915.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6"},{"type":"WEB","url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101915.json"},{"type":"ADVISORY","url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101915"},{"type":"FIX","url":"https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea"},{"type":"FIX","url":"https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f"},{"type":"FIX","url":"https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grpc/grpc-node","events":[{"introduced":"0"},{"introduced":"7db315d094b737f105fd7265dd69ab6d2a7bb2a1"},{"fixed":"5296a05fd584fdd003616a7c00f1c230c95c0de6"},{"fixed":"56567d9604b4e45cdca0d2e3c2a60ac227ee659d"},{"fixed":"350de32860428cc62473a00bee4035360690ffea"},{"fixed":"7c5c5181159c6ddd292805881ef2cdec29bb475f"},{"fixed":"e8329b122ca99ba10877e990c2f6edd40224fd0d"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.13.6"},{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}}],"versions":["@grpc/grpc-js@1.13.5","@grpc/grpc-js@1.14.4","@grpc/proto-loader@0.8.1","@grpc/grpc-js@1.14.3","@grpc/grpc-js@1.14.2","@grpc/grpc-js@1.14.1","grpc-tools@1.13.1","@grpc/grpc-js@1.14.0","@grpc/grpc-js-xds@1.14.0","grpc-health-check@2.1.0","@grpc/grpc-js@1.13.4","@grpc/grpc-js@1.13.3","@grpc/proto-loader@0.7.15","@grpc/proto-loader@0.7.14","@grpc/grpc-js@1.13.2","@grpc/grpc-js@1.13.1","@grpc/grpc-js@1.13.0","@grpc/grpc-js-xds@1.13.0","grpc-tool@1.13.0","@grpc/reflection@1.0.3","grpc-health-check@2.0.2","@grpc/reflection@1.0.4","@grpc/proto-loader@0.7.13","@grpc/proto-loader@0.7.12","@grpc/proto-loader@0.7.11","@grpc/grpc-js@1.10.4","@grpc/reflection@1.0.2","grpc-health-check@2.0.1","@grpc/reflection@1.0.1","@grpc/reflection@1.0.0","grpc-health-check@2.0.0","@grpc/proto-loader@0.7.10","@grpc/proto-loader@0.7.9","@grpc/proto-loader@0.7.7","@grpc/proto-loader@0.7.6","@grpc/proto-loader@0.7.5","grpc-tools@1.12.4","grpc-tools@1.12.0","grpc-tools@1.12.3","@grpc/grpc-js@1.8.0","@grpc/grpc-js-xds@1.8.0","@grpc/proto-loader@0.7.4","grpc-tools@1.12.2","grpc-tools@1.12.1","grpc-tools@1.11.3","@grpc/proto-loader@0.7.3","@grpc/proto-loader@0.7.2","@grpc/proto-loader@0.7.1","@grpc/proto-loader@0.6.13","@grpc/proto-loader@0.6.12","@grpc/proto-loader@0.6.11","@grpc/proto-loader@0.6.10","@grpc/proto-loader@0.6.9","@grpc/proto-loader@0.6.8","@grpc/proto-loader@0.6.6","@grpc/proto-loader@0.6.5","@grpc/proto-loader@0.6.4","@grpc/proto-loader@0.6.3","@grpc/grpc-js@1.3.4","grpc-tools@1.11.2","@grpc/proto-loader@0.6.2","@grpc/proto-loader@0.6.1","@grpc/proto-loader@0.6.0","grpc-tools@1.11.0","@grpc/grpc-js-xds@1.2.4","@grpc/proto-loader@0.5.6","@grpc/grpc-js@1.2.0","@grpc/grpc-js@1.1.6","@grpc/grpc-js@1.1.4","@grpc/grpc-js@1.1.3","grpc-tools@1.9.1","@grpc/grpc-js@1.1.2","@grpc/grpc-js@1.1.0","grpc@1.24.3","@grpc/grpc-js@1.0.5","@grpc/grpc-js@1.0.2","grpc-tools@1.9.0","@grpc/grpc-js@1.0.4","@grpc/grpc-js@1.0.3","@grpc/grpc-js@1.0.0","@grpc/grpc-js@0.7.9","@grpc/grpc-js@0.8.1","@grpc/grpc-js@0.8.0","@grpc/grpc-js@0.7.6","@grpc/grpc-js@0.7.5","@grpc/proto-loader@0.5.4","@grpc/grpc-js@0.7.2","@grpc/grpc-js@0.7.1","@grpc/grpc-js@0.7.0","@grpc/grpc-js@0.6.18","@grpc/grpc-js@0.6.12","@grpc/grpc-js@0.6.5","grpc@1.23.4","@grpc/grpc-js@0.6.4","@grpc/grpc-js@0.6.3","@grpc/grpc-js@0.6.2","@grpc/grpc-js@0.6.1","@grpc/grpc-js@0.6.0","@grpc/grpc-js@0.5.3","@grpc/proto-loader@0.5.2","@grpc/grpc-js@0.5.0","@grpc/grpc-js@0.5.2","@grpc/grpc-js@0.5.1","grpc-tools@1.8.0","@grpc/grpc-js@0.4.3","@grpc/grpc-js@0.4.2","@grpc/proto-loader@0.5.1","@grpc/grpc-js@0.4.0","@grpc/proto-loader@0.5.0","grpc-tools@1.7.2","@grpc/grpc-js@0.3.6","grpc-tools@1.7.0","@grpc/proto-loader@0.4.0","@grpc/grpc-js@0.3.4","@grpc/grpc-js@0.3.3","@grpc/grpc-js@0.3.1","@grpc/grpc-js@0.3.0","@grpc/proto-loader@0.3.0","@grpc/grpc-js@0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101915.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}