gRPC for Node.js provides client and server implementations for the gRPC framework, including a pure JavaScript option using the @grpc/grpc-js package (no C++ addon). It also includes supporting packages like @grpc/proto-loader for loading .proto files, grpc-tools for distributing protoc and the Node gRPC plugin, and health check and reflection services for gRPC servers.
Project status
- Actively maintained: The
grpc/grpc-noderepo shows a recent upstream push on 2026-06-17, and there have been multiple@grpc/grpc-jsupdates in 2026 (notably several on 2026-05-20), indicating ongoing development rather than maintenance mode. - Update cadence: Clustered patch updates in May 2026 (several
@grpc/grpc-jsversions on the same day), after which the most recent listed core update is 2026-05-20, with the repo itself receiving an upstream push again in mid-June 2026. Compared to earlier activity, there was a gap back to Dec 2025 in the provided summaries.
AI summary generated
Recent updates
@grpc/grpc-js@1.9.16
Release notes for @grpc/grpc-js 1.9.16 describe two security-related crash fixes involving malformed requests and malformed compressed messages. The code diff shows additional, substantial behavior changes around message decompression and max message size enforcement that are not mentioned in the release notes.
Security@grpc/grpc-js@1.10.12
grpc-js 1.10.12 release notes document security-related crash fixes for servers and clients when handling malformed requests and malformed compressed messages. The provided code diff, however, is dominated by changes in the grpc-js-xds generated Envoy TypeScript type definitions, not by grpc-js core networking logic.
SecurityFeatures@grpc/grpc-js@1.11.4
This @grpc/grpc-js 1.11.4 release notes only mention two security bug fixes related to crashes caused by malformed requests and malformed compressed messages. The code diff, however, shows a large set of grpc-js-xds related changes, including new experimental configuration flags and many generated Envoy xDS schema updates.
Security@grpc/grpc-js@1.12.7
Release @grpc/grpc-js 1.12.7 claims two security fixes, both addressing crashes caused by malformed requests and malformed compressed messages (GHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq). The actual diff shows those crash-related hardening changes, but it also introduces multiple additional behavior and API surface changes that are not mentioned in the release notes.
BreakingSecurity@grpc/grpc-js@1.13.5
grpc-js 1.13.5 contains fixes aimed at preventing crashes when the server or client receives malformed input, especially malformed compressed gRPC payloads. The code changes primarily add explicit zlib decompressor error handling and adjust where HTTP2 stream error events are caught to avoid uncaught error exceptions.
Security@grpc/grpc-js@1.14.4
grpc-js 1.14.4 includes two security-related fixes intended to prevent crashes when processing malformed requests and malformed compressed messages. The provided diff also shows additional functional changes outside the release notes, including new health-check RPC support and changes to default xDS experimental feature flags.
SecurityFeatures@grpc/proto-loader@0.8.1
The release @grpc/proto-loader 0.8.1 is documented as a dependency bump to protobufjs to pick up security fixes. However, the provided code diff shows multiple grpc-js and grpc-js-xds behavior changes related to proxy configuration, retry/half-close timing, session shutdown semantics, and x509 principal CN matching that are not mentioned in the release notes.
SecurityFeatures@grpc/grpc-js@1.14.3
grpc-js 1.14.3 updates the retrying call write path to address cases where halfClose could be sent late, particularly when interacting with Envoy. The release notes mention sending halfClose immediately after messages, but the code changes include additional timing and state-management modifications in the retrying-call implementation.
@grpc/grpc-js@1.14.2
grpc-js 1.14.2 is a small patch release with an emphasis on server keepalive behavior during ping failures/timeouts. The code changes adjust how the HTTP/2 session is terminated when keepalive pings fail, and it also tweaks underlying transport session limits.
grpc-tools@1.13.1
grpc-tools 1.13.1 release notes only mention updating node-pre-gyp. However, the provided code diff shows additional changes inside grpc-js, most notably adding a new 'grpc.http_proxy' channel option that affects how proxy settings are selected and logged. It also adds x509 certificate test/example data and helper scripts.
Features