All vulnerabilities
CVE-2026-101914GHSA-88h9-xgvx-hvf2

@grpc/grpc-js-xds: @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

grpc @grpc/grpc-js-xdsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.13.1Also 1.14.1GitHub
Published28 Sep 2026Updated 14 Oct 2026CVE List

What fixes it

  • 1.13.1@grpc/grpc-js-xds, npmGitHubnpm install @grpc/grpc-js-xds@1.13.1
  • 1.14.1@grpc/grpc-js-xds, npmGitHubnpm install @grpc/grpc-js-xds@1.14.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication.

Patches

This vulnerability is fixed in 1.13.1 and 1.14.1.

Workarounds

This problem can be avoided by enabling case-sensitive path matching.

Text from GitHub Advisory Database

Affected versions 7

  • @grpc/grpc-js-xds, npm< 1.13.1GitHub
  • @grpc/grpc-js-xds, npm= 1.14.0GitHub
  • grpc-nodeaffected: < 1.13.1CVE List
  • grpc-nodeaffected: >= 1.14.0, < 1.14.1CVE List
  • @grpc/grpc-js-xds, npmfrom first release, fixed in 1.13.1OSV
  • @grpc/grpc-js-xds, npmfrom 1.14.0, fixed in 1.14.1OSV
  • @grpc/grpc-js-xds, npm1.14.0OSV

References 7