Medium severity · published Sep 28, 2026
CVE-2026-101914
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grpc-node · grpc
< 1.13.1; >= 1.14.0, < 1.14.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101914
x_refsource_CONFIRM
https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2
x_refsource_MISC
https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4
x_refsource_MISC
https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f
x_refsource_MISC
https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75
x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1
More from grpc-node
7.5
CVE-2026-48069
@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
7.5
CVE-2026-48068
@grpc/grps-js: A malformed request can cause a server crash
7.4
CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
5.3
CVE-2024-37168
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
3.7
CVE-2026-101915
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages