Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
grpc-node 1.14 1.14.0 → < 1.14.1 1.14.1
grpc-node 1.13 premières → < 1.13.1 1.13.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de grpc-node

Les 6 CVE de grpc-node →
CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.4 Élevée CVE-2026-101915 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 3.7 Faible CVE-2026-48069 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.5 Élevée CVE-2026-48068 @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon 7.5 Élevée
Suivre cette CVE