Skip to content
fr Sign in
6.5 Medium

CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Affected products and versions

Product Affected versions Fixed in
grpc-node 1.14 1.14.0 → < 1.14.1 1.14.1
grpc-node 1.13 earliest → < 1.13.1 1.13.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of grpc-node

The 6 CVEs of grpc-node →
CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.4 High CVE-2026-101915 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 3.7 Low CVE-2026-48069 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.5 High CVE-2026-48068 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.5 High
Track this CVE