GitHub Advisoryadvisory · npm

GHSA-88h9-xgvx-hvf2 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

MEDIUM Published 2026-09-28 Modified 2026-09-28 Official page ↗
Aliases
CVE-2026-101914
Ecosystem
npm
Packages
@grpc/grpc-js-xds
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-187, CWE-863
Reviewed
2026-09-28

Affected packages

• npm @grpc/grpc-js-xds: < 1.13.1 → fixed in 1.13.1 • npm @grpc/grpc-js-xds: >= 1.14.0, < 1.14.1 → fixed in 1.14.1

Description

Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication. Patches This vulnerability is fixed in 1.13.1 and 1.14.1. Workarounds This problem can be avoided by enabling case-sensitive path matching.

Related

Alias · CVE (1)

  • CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. vulnerability

Weakness · CWE (2)

  • CWE-187 Partial String Comparison weakness
  • CWE-863 Incorrect Authorization weakness

References