CVE-2026-101914

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-101914

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101914.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-101914

Aliases

GHSA-88h9-xgvx-hvf2

Published

2026-09-28T19:36:55Z

Modified

2026-10-21T02:54:27Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Details

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-187",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101914.json"
}

References

Affected packages

Git / github.com/grpc/grpc-node

Affected ranges

Type

GIT

Repo

https://github.com/grpc/grpc-node

Events

Introduced

Fixed

83acea8513657debe36edefdc87f498ed0ecc035

Introduced

7db315d094b737f105fd7265dd69ab6d2a7bb2a1

Fixed

8ce94a48ce59c2b73ce10a873aa4c55cdf806605

Fixed

6cf64b596da03f1942a6b168998f0670217a99c4

Fixed

a6c5b31180cc8cea94d0a5ea215ce31a49e0409f

Fixed

f32f3712e44581d8dfc8359bd8d30096662f4c75

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.13.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "fixed":  "1.14.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "6cf64b596da03f1942a6b168998f0670217a99c4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "a6c5b31180cc8cea94d0a5ea215ce31a49e0409f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "f32f3712e44581d8dfc8359bd8d30096662f4c75"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@grpc/grpc-js-xds@1.*

@grpc/grpc-js-xds@1.13.0

@grpc/grpc-js-xds@1.14.0

@grpc/grpc-js-xds@1.2.4

@grpc/grpc-js-xds@1.8.0

@grpc/grpc-js@0.*

@grpc/grpc-js@0.2.0

@grpc/grpc-js@0.3.0

@grpc/grpc-js@0.3.1

@grpc/grpc-js@0.3.3

@grpc/grpc-js@0.3.4

@grpc/grpc-js@0.3.6

@grpc/grpc-js@0.4.0

@grpc/grpc-js@0.4.2

@grpc/grpc-js@0.4.3

@grpc/grpc-js@0.5.0

@grpc/grpc-js@0.5.1

@grpc/grpc-js@0.5.2

@grpc/grpc-js@0.5.3

@grpc/grpc-js@0.6.0

@grpc/grpc-js@0.6.1

@grpc/grpc-js@0.6.12

@grpc/grpc-js@0.6.18

@grpc/grpc-js@0.6.2

@grpc/grpc-js@0.6.3

@grpc/grpc-js@0.6.4

@grpc/grpc-js@0.6.5

@grpc/grpc-js@0.7.0

@grpc/grpc-js@0.7.1

@grpc/grpc-js@0.7.2

@grpc/grpc-js@0.7.5

@grpc/grpc-js@0.7.6

@grpc/grpc-js@0.7.9

@grpc/grpc-js@0.8.0

@grpc/grpc-js@0.8.1

@grpc/grpc-js@1.*

@grpc/grpc-js@1.0.0

@grpc/grpc-js@1.0.2

@grpc/grpc-js@1.0.3

@grpc/grpc-js@1.0.4

@grpc/grpc-js@1.0.5

@grpc/grpc-js@1.1.0

@grpc/grpc-js@1.1.2

@grpc/grpc-js@1.1.3

@grpc/grpc-js@1.1.4

@grpc/grpc-js@1.1.6

@grpc/grpc-js@1.10.4

@grpc/grpc-js@1.13.0

@grpc/grpc-js@1.13.1

@grpc/grpc-js@1.13.2

@grpc/grpc-js@1.13.3

@grpc/grpc-js@1.13.4

@grpc/grpc-js@1.13.5

@grpc/grpc-js@1.14.0

@grpc/grpc-js@1.14.1

@grpc/grpc-js@1.14.2

@grpc/grpc-js@1.14.3

@grpc/grpc-js@1.14.4

@grpc/grpc-js@1.2.0

@grpc/grpc-js@1.3.4

@grpc/grpc-js@1.8.0

@grpc/proto-loader@0.*

@grpc/proto-loader@0.3.0

@grpc/proto-loader@0.4.0

@grpc/proto-loader@0.5.0

@grpc/proto-loader@0.5.1

@grpc/proto-loader@0.5.2

@grpc/proto-loader@0.5.4

@grpc/proto-loader@0.5.6

@grpc/proto-loader@0.6.0

@grpc/proto-loader@0.6.1

@grpc/proto-loader@0.6.10

@grpc/proto-loader@0.6.11

@grpc/proto-loader@0.6.12

@grpc/proto-loader@0.6.13

@grpc/proto-loader@0.6.2

@grpc/proto-loader@0.6.3

@grpc/proto-loader@0.6.4

@grpc/proto-loader@0.6.5

@grpc/proto-loader@0.6.6

@grpc/proto-loader@0.6.8

@grpc/proto-loader@0.6.9

@grpc/proto-loader@0.7.1

@grpc/proto-loader@0.7.10

@grpc/proto-loader@0.7.11

@grpc/proto-loader@0.7.12

@grpc/proto-loader@0.7.13

@grpc/proto-loader@0.7.14

@grpc/proto-loader@0.7.15

@grpc/proto-loader@0.7.2

@grpc/proto-loader@0.7.3

@grpc/proto-loader@0.7.4

@grpc/proto-loader@0.7.5

@grpc/proto-loader@0.7.6

@grpc/proto-loader@0.7.7

@grpc/proto-loader@0.7.9

@grpc/proto-loader@0.8.1

@grpc/reflection@1.*

@grpc/reflection@1.0.0

@grpc/reflection@1.0.1

@grpc/reflection@1.0.2

@grpc/reflection@1.0.3

@grpc/reflection@1.0.4

grpc-health-check@2.*

grpc-health-check@2.0.0

grpc-health-check@2.0.1

grpc-health-check@2.0.2

grpc-health-check@2.1.0

grpc-tool@1.*

grpc-tool@1.13.0

grpc-tools@1.*

grpc-tools@1.11.0

grpc-tools@1.11.2

grpc-tools@1.11.3

grpc-tools@1.12.0

grpc-tools@1.12.1

grpc-tools@1.12.2

grpc-tools@1.12.3

grpc-tools@1.12.4

grpc-tools@1.13.1

grpc-tools@1.7.0

grpc-tools@1.7.2

grpc-tools@1.8.0

grpc-tools@1.9.0

grpc-tools@1.9.1

grpc@1.*

grpc@1.13.0

grpc@1.14.0

grpc@1.23.4

grpc@1.24.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101914.json"