CVE-2026-101914CWE-187CWE-863broken-access-control

CVE-2026-101914

Medium · published September 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
15.6
In the wild
Unconfirmed
What it is

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.6th percentile
Weaknesses
CWE-187 · Partial String Comparison; CWE-863 · Incorrect Authorization
Published
2026-09-29T00:17Z
References (6)
https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4 · [email protected]https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f · [email protected]https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75 · [email protected]https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1 · [email protected]https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1 · [email protected]https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2 · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 19:36Z
    @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
    cvelistv5