cyfenced.com →

[ CVE-2026-101914 · Published 28 Sep 2026 ]

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

CVSS 6.5 EPSS <1%Fix available

[ Description ]Official description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

[ Fixes ]Fixes and patches

  • @grpc/grpc-js-xds 1.13.1Fixed version · GitHub Advisories · npm package @grpc/grpc-js-xds: upgrade to 1.13.1 or later (affected < 1.13.1)
  • @grpc/grpc-js-xds 1.14.1Fixed version · GitHub Advisories · npm package @grpc/grpc-js-xds: upgrade to 1.14.1 or later (affected = 1.14.0)

[ Packages ]Affected open-source packages

[ References ]References