6.5
Moyenne
CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
Produits et versions touchés
Autres CVE de grpc-node
Les 6 CVE de grpc-node →
CVE-2026-101916
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
7.4
Élevée
CVE-2026-101915
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
3.7
Faible
CVE-2026-48069
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
7.5
Élevée
CVE-2026-48068
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
7.5
Élevée