CVE-2026-101915: 
JavaScript vulnerability analysis and mitigation

CVE-2026-101915 is an information disclosure vulnerability in @grpc/grpc-js, the pure JavaScript implementation of gRPC for Node.js. When an application method handler throws an uncaught error, the library includes the full error message in the gRPC status message returned to the client, potentially exposing sensitive data such as credentials or tokens. The vulnerability affects all versions prior to 1.13.6 and versions 1.14.0 through 1.14.5 (exclusive). It was published on September 28, 2026, with patches released on September 17, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is classified as CWE-550 (Server-generated Error Message Containing Sensitive Information). In the vulnerable code, all four handler types — unary, client-streaming, server-streaming, and bidirectional streaming — catch uncaught exceptions and unconditionally embed the raw Error.message string into the gRPC status detail field sent back to the client. An attacker can trigger this behavior by sending requests crafted to cause the server-side handler to throw an error (e.g., malformed input, boundary conditions), then reading the status message in the gRPC response to extract whatever sensitive data the error message contains. The fix introduces a new environment variable GRPC_NODE_DEBUG_SEND_ERROR_DETAILS (defaulting to false) that replaces the raw error message with a generic 'Unknown error' string unless explicitly enabled for debugging (GitHub Advisory, Patch Commit).

Successful exploitation results in a low-severity confidentiality impact: sensitive data embedded in server-side error messages — such as database connection strings, API keys, credentials, or internal system paths — may be disclosed to unauthenticated network clients. There is no impact on integrity or availability. The scope is limited to information leakage from the affected gRPC server process; lateral movement is not directly enabled by this vulnerability alone, though disclosed credentials could facilitate further attacks (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.0025 (0.25%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity, as the attacker must be able to trigger an uncaught error in a specific method handler that happens to include sensitive data in its message.

1. Reconnaissance: Identify gRPC services running @grpc/grpc-js versions prior to 1.13.6 or between 1.14.0 and 1.14.5 using network scanning or service fingerprinting tools (e.g., grpcurl, Nmap with gRPC probes).
2. Enumerate RPC methods: Use reflection or known service definitions to list available RPC methods on the target server.
3. Craft error-triggering requests: Send malformed, boundary-violating, or unexpected inputs to individual RPC methods designed to cause the server-side handler to throw an uncaught JavaScript error.
4. Observe status messages: Capture the gRPC response status detail field (e.g., using grpcurl or a custom gRPC client) and inspect it for sensitive information such as credentials, tokens, file paths, or internal error details embedded in the error message.
5. Leverage disclosed data: Use any extracted credentials or tokens for further unauthorized access to backend systems (GitHub Advisory).

• Network: Repeated gRPC requests to multiple RPC endpoints with malformed or boundary-condition payloads from a single source IP, particularly requests that consistently result in Status.UNKNOWN responses.
• Logs: Server-side application logs showing repeated uncaught exceptions in method handlers; gRPC access logs showing a high rate of UNKNOWN status codes returned to a specific client.
• Application Behavior: gRPC status messages containing strings matching the pattern Server method handler threw error <message> visible in client-side logs or network captures, indicating the server is running an unpatched version.

Upgrade @grpc/grpc-js to version 1.13.6 or 1.14.5 (or later), which replace raw error messages in status details with a generic 'Unknown error' string by default (Release 1.13.6, GitHub Advisory). As a workaround prior to patching, implement top-level try/catch blocks in all gRPC method handlers to intercept errors and return sanitized status messages that do not include sensitive data. Ensure the environment variable GRPC_NODE_DEBUG_SEND_ERROR_DETAILS is not set to true in production environments, as this re-enables the verbose error disclosure behavior (Patch Commit).