CVE-2026-101914
MediumCVSS 6.5Summary
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. Fixed in versions 1.13.1 and 1.14.1.
Risk Assessment
Incorrect authorization may allow an unauthorized user to access methods they should not have access to, potentially leading to data security breaches.
Recommendation
Upgrade @grpc/grpc-js to version 1.13.1 or 1.14.1 (or later), which includes the fix.
Other vulnerabilities in @grpc/grpc-js
See all- CVE-2026-101916High
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations.
- CVE-2026-101915Low
In @grpc/grpc-js prior to versions 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. This causes sensitive information disclosure when the message contains sensitive data.
- CVE-2026-48069High
A vulnerability in the @grpc/grpc-js library allows an attacker to send an invalid compressed message, causing a crash of the client or server process. The issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- CVE-2026-48068High
A vulnerability in the @grpc/grpc-js library allows remote crash of the server by sending an invalid HTTP/2 stream initiation request. Affected versions are prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
Original NVD description (English source)
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS