gRPC for Node.js provides client and server implementations for the gRPC framework, including a pure JavaScript option using the @grpc/grpc-js package (no C++ addon). It also includes supporting packages like @grpc/proto-loader for loading .proto files, grpc-tools for distributing protoc and the Node gRPC plugin, and health check and reflection services for gRPC servers.
Project status
- Actively maintained: upstream was pushed on 2026-10-29, with multiple package updates that day.
- Updates have been frequent recently, including several rounds in September and October 2026, though the evidence does not establish a regular schedule.
AI summary generated
Recent updates
@grpc/grpc-js@1.14.7
@grpc/grpc-js 1.14.7 fixes two bugs in automatic retry behavior. Retries now stop when a call is cancelled and trigger correctly in cases where they previously did not.
@grpc/grpc-js-xds@1.14.2
@grpc/grpc-js-xds 1.14.2 fixes two issues covered by security advisories: overly permissive safe_regex matching and HTTP filter override configs not being applied. It also fixes clients accepting xDS resources from the wrong authority. The supplied diff additionally shows notable undocumented additions and a change to the default state of xDS federation.
Security@grpc/grpc-js-xds@1.13.2
@grpc/grpc-js-xds 1.13.2 fixes overly permissive matching by safe_regex string matchers, as described in the release notes and GHSA-r7hq-q2xm-6c5m. The code diff also changes case-insensitive path matching, server error details, decompression error handling, and the supported @grpc/grpc-js peer dependency range.
BreakingSecurityFeatures@grpc/grpc-js@1.14.6
grpc-js 1.14.6 focuses on security hardening (GHSA-f596-whhp-79r4) and a series of hot-path allocation reductions on request/channel tracking paths. The code diff, however, also includes additional behavioral and API surface changes not mentioned in the release notes, notably in the grpc-health-check service and xDS experimental configuration defaults.
BreakingSecurityFeatures@grpc/grpc-js@1.13.7
grpc-js 1.13.7 release notes claim it addresses remaining instances of security advisory GHSA-f596-whhp-79r4. The code diff shows multiple behavioral changes beyond a simple advisory fix, including matcher logic changes in grpc-js-xds and new/changed error-detail reporting controlled by a new environment variable.
BreakingSecurityFeatures@grpc/grpc-js-xds@1.14.1
Release @grpc/grpc-js-xds 1.14.1 primarily contains bug fixes related to xDS RBAC path matcher semantics and weighted cluster total calculation. The diff also shows additional, largely undocumented changes including new health RPC support and new experimental feature flags, plus large-scale generated protobuf type additions.
Security@grpc/grpc-js@1.14.5
grpc-js 1.14.5 primarily addresses security and correctness issues around TLS/auth context handling, call metadata cleanup, and HTTP/2 stream behavior. The documented changes are bug fixes plus a few trace/telemetry related improvements, and two security advisories related to error detail handling and certificate verification.
Security@grpc/grpc-js-xds@1.13.1
grpc-js-xds 1.13.1 primarily documents a fix to an RBAC matching bug, where exact path matchers in case-insensitive mode incorrectly behaved like prefix matchers. The provided code diff, however, shows many additional changes across the repository (new health check implementation, reflection documentation, environment variable documentation, and CI workflow updates) that are not described in the release notes.
Security@grpc/grpc-js@1.13.6
This release primarily addresses a security issue where the server could send excessive error details to clients by default. The code now gates detailed server-thrown handler error messages behind a new environment variable, falling back to a generic 'Unknown error' response unless explicitly enabled.
BreakingSecurityFeatures@grpc/grpc-js@1.9.16
Release notes for @grpc/grpc-js 1.9.16 describe two security-related crash fixes involving malformed requests and malformed compressed messages. The code diff shows additional, substantial behavior changes around message decompression and max message size enforcement that are not mentioned in the release notes.
Security@grpc/grpc-js@1.10.12
grpc-js 1.10.12 release notes document security-related crash fixes for servers and clients when handling malformed requests and malformed compressed messages. The provided code diff, however, is dominated by changes in the grpc-js-xds generated Envoy TypeScript type definitions, not by grpc-js core networking logic.
SecurityFeatures@grpc/grpc-js@1.11.4
This @grpc/grpc-js 1.11.4 release notes only mention two security bug fixes related to crashes caused by malformed requests and malformed compressed messages. The code diff, however, shows a large set of grpc-js-xds related changes, including new experimental configuration flags and many generated Envoy xDS schema updates.
Security@grpc/grpc-js@1.12.7
Release @grpc/grpc-js 1.12.7 claims two security fixes, both addressing crashes caused by malformed requests and malformed compressed messages (GHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq). The actual diff shows those crash-related hardening changes, but it also introduces multiple additional behavior and API surface changes that are not mentioned in the release notes.
BreakingSecurity@grpc/grpc-js@1.13.5
grpc-js 1.13.5 contains fixes aimed at preventing crashes when the server or client receives malformed input, especially malformed compressed gRPC payloads. The code changes primarily add explicit zlib decompressor error handling and adjust where HTTP2 stream error events are caught to avoid uncaught error exceptions.
Security@grpc/grpc-js@1.14.4
grpc-js 1.14.4 includes two security-related fixes intended to prevent crashes when processing malformed requests and malformed compressed messages. The provided diff also shows additional functional changes outside the release notes, including new health-check RPC support and changes to default xDS experimental feature flags.
SecurityFeatures@grpc/proto-loader@0.8.1
The release @grpc/proto-loader 0.8.1 is documented as a dependency bump to protobufjs to pick up security fixes. However, the provided code diff shows multiple grpc-js and grpc-js-xds behavior changes related to proxy configuration, retry/half-close timing, session shutdown semantics, and x509 principal CN matching that are not mentioned in the release notes.
SecurityFeatures@grpc/grpc-js@1.14.3
grpc-js 1.14.3 updates the retrying call write path to address cases where halfClose could be sent late, particularly when interacting with Envoy. The release notes mention sending halfClose immediately after messages, but the code changes include additional timing and state-management modifications in the retrying-call implementation.
@grpc/grpc-js@1.14.2
grpc-js 1.14.2 is a small patch release with an emphasis on server keepalive behavior during ping failures/timeouts. The code changes adjust how the HTTP/2 session is terminated when keepalive pings fail, and it also tweaks underlying transport session limits.
grpc-tools@1.13.1
grpc-tools 1.13.1 release notes only mention updating node-pre-gyp. However, the provided code diff shows additional changes inside grpc-js, most notably adding a new 'grpc.http_proxy' channel option that affects how proxy settings are selected and logged. It also adds x509 certificate test/example data and helper scripts.
Features