@grpc/grpc-js Denial-of-Service Vulnerability via Malformed Compressed Messages

A denial-of-service vulnerability has been identified in the @grpc/grpc-js package, which implements gRPC functionality in JavaScript without a C++ addon. This vulnerability affects versions prior to 1.9.16, as well as 1.10.0 through 1.10.12, 1.11.0 through 1.11.4, 1.12.0 through 1.12.7, 1.13.0 through 1.13.5, and 1.14.0 through 1.14.4. The issue arises when a client or server process receives an invalid incoming compressed message, leading to a crash.

Impact

Exploitation of this vulnerability causes the client or server process to crash, disrupting any ongoing operations or services.

Reproduction

The vulnerability can be reproduced by sending an invalid compressed message to a gRPC server or client that uses the affected version of the @grpc/grpc-js package. This can be done by creating a gRPC service that accepts compressed messages and then sending a malformed message that violates the expected compression format. The server or client will crash upon receiving the invalid message.

Remediation

Users can upgrade to @grpc/grpc-js versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4, all of which include the necessary fix.