@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grpc | grpc-node | before 1.13.1; 1.14.0 to before 1.14.1 | 1.13.1, 1.14.1 | Patch available | CNA |
| — | @grpc/grpc-js-xds (npm) | before 1.13.1 | 1.13.1 | Patch available | GHSA-88h9-xgvx-hvf2 |
| — | @grpc/grpc-js-xds (npm) | 1.14.0 to before 1.14.1 | 1.14.1 | Patch available | GHSA-88h9-xgvx-hvf2 |
- grpc-node Vendorgrpc Affected before 1.13.1; 1.14.0 to before 1.14.1 Fixed in 1.13.1, 1.14.1 Patch available CNA
- @grpc/grpc-js-xds (npm) Vendor— Affected before 1.13.1 Fixed in 1.13.1 Patch available GHSA-88h9-xgvx-hvf2
- @grpc/grpc-js-xds (npm) Vendor— Affected 1.14.0 to before 1.14.1 Fixed in 1.14.1 Patch available GHSA-88h9-xgvx-hvf2
Remediation
- Fix · CNA grpc-node (grpc) Fixed in 1.13.1, 1.14.1
- Fix · GHSA-88h9-xgvx-hvf2 @grpc/grpc-js-xds (npm) Fixed in 1.13.1 Advisory →
- Fix · GHSA-88h9-xgvx-hvf2 @grpc/grpc-js-xds (npm) Fixed in 1.14.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-101914
- 2026-10-03 Alias added: GHSA-88h9-xgvx-hvf2
- 2026-10-14 2 new references · GHSA-88h9-xgvx-hvf2
References
Other 7
- https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2
- https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4
- https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f
- https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1
- https://github.com/grpc/grpc-node
More grpc vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-25614 gRPC-Go has an authorization bypass via missing leading slash in :path CVSS 3.1CRITICAL 9.1
- TI-2020-06285 Prototype pollution in grpc CVSS 3.1CRITICAL 9.8
- TI-2017-05916 Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based… CVSS 3.0CRITICAL 9.8
- TI-2017-05476 Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
- TI-2017-06843 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-101914 · CVE Program
- CVE-2026-101914 · NVD
- FIRST EPSS
- GHSA-88h9-xgvx-hvf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences