[ Vendor · 4 CVEs ]
grpc
CVEs affecting grpc published in the last 30 days, plus any grpc CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101916 | 28 Sep 2026 | CVSS 7.4 | @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does… | Fix |
| CVE-2026-101914 | 28 Sep 2026 | CVSS 6.5 | @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method… | Fix |
| CVE-2026-101915 | 28 Sep 2026 | CVSS 3.7 | @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application… | Fix |
| CVE-2026-84445 | 14 Sep 2026 | CVSS 8.7 | grpc-gogRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow… |