CVE-2026-126367

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126367
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126367.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126367
Aliases
Published
2026-11-12T22:43:36Z
Modified
2026-11-13T10:47:08Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
Details

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-625",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126367.json"
}
References

Affected packages

Git / github.com/grpc/grpc-node

Affected ranges

Type
GIT
Repo
https://github.com/grpc/grpc-node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9652680c5a951544239fb35c1fcc2715359ef3ce
Introduced
7db315d094b737f105fd7265dd69ab6d2a7bb2a1
Fixed
9eedd43da1ec61d5a4c79b0f037ef96c3367ba4f
Fixed
3fc3b0ebf7a89d64843a73679951142d33b40cb1
Fixed
57a67e96babcb29b6eabc1833221ccf2fa152d43
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.13.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "1.14.0"
                },
                {
                    "fixed": "1.14.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "3fc3b0ebf7a89d64843a73679951142d33b40cb1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "57a67e96babcb29b6eabc1833221ccf2fa152d43"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@grpc/grpc-js-xds@1.*
@grpc/grpc-js-xds@1.13.0
@grpc/grpc-js-xds@1.14.0
@grpc/grpc-js-xds@1.14.1
@grpc/grpc-js-xds@1.2.4
@grpc/grpc-js-xds@1.8.0
@grpc/grpc-js@0.*
@grpc/grpc-js@0.2.0
@grpc/grpc-js@0.3.0
@grpc/grpc-js@0.3.1
@grpc/grpc-js@0.3.3
@grpc/grpc-js@0.3.4
@grpc/grpc-js@0.3.6
@grpc/grpc-js@0.4.0
@grpc/grpc-js@0.4.2
@grpc/grpc-js@0.4.3
@grpc/grpc-js@0.5.0
@grpc/grpc-js@0.5.1
@grpc/grpc-js@0.5.2
@grpc/grpc-js@0.5.3
@grpc/grpc-js@0.6.0
@grpc/grpc-js@0.6.1
@grpc/grpc-js@0.6.12
@grpc/grpc-js@0.6.18
@grpc/grpc-js@0.6.2
@grpc/grpc-js@0.6.3
@grpc/grpc-js@0.6.4
@grpc/grpc-js@0.6.5
@grpc/grpc-js@0.7.0
@grpc/grpc-js@0.7.1
@grpc/grpc-js@0.7.2
@grpc/grpc-js@0.7.5
@grpc/grpc-js@0.7.6
@grpc/grpc-js@0.7.9
@grpc/grpc-js@0.8.0
@grpc/grpc-js@0.8.1
@grpc/grpc-js@1.*
@grpc/grpc-js@1.0.0
@grpc/grpc-js@1.0.2
@grpc/grpc-js@1.0.3
@grpc/grpc-js@1.0.4
@grpc/grpc-js@1.0.5
@grpc/grpc-js@1.1.0
@grpc/grpc-js@1.1.2
@grpc/grpc-js@1.1.3
@grpc/grpc-js@1.1.4
@grpc/grpc-js@1.1.6
@grpc/grpc-js@1.10.4
@grpc/grpc-js@1.13.0
@grpc/grpc-js@1.13.1
@grpc/grpc-js@1.14.0
@grpc/grpc-js@1.14.1
@grpc/grpc-js@1.14.2
@grpc/grpc-js@1.14.3
@grpc/grpc-js@1.14.4
@grpc/grpc-js@1.14.5
@grpc/grpc-js@1.14.6
@grpc/grpc-js@1.2.0
@grpc/grpc-js@1.3.4
@grpc/grpc-js@1.8.0
@grpc/proto-loader@0.*
@grpc/proto-loader@0.3.0
@grpc/proto-loader@0.4.0
@grpc/proto-loader@0.5.0
@grpc/proto-loader@0.5.1
@grpc/proto-loader@0.5.2
@grpc/proto-loader@0.5.4
@grpc/proto-loader@0.5.6
@grpc/proto-loader@0.6.0
@grpc/proto-loader@0.6.1
@grpc/proto-loader@0.6.10
@grpc/proto-loader@0.6.11
@grpc/proto-loader@0.6.12
@grpc/proto-loader@0.6.13
@grpc/proto-loader@0.6.2
@grpc/proto-loader@0.6.3
@grpc/proto-loader@0.6.4
@grpc/proto-loader@0.6.5
@grpc/proto-loader@0.6.6
@grpc/proto-loader@0.6.8
@grpc/proto-loader@0.6.9
@grpc/proto-loader@0.7.1
@grpc/proto-loader@0.7.10
@grpc/proto-loader@0.7.11
@grpc/proto-loader@0.7.12
@grpc/proto-loader@0.7.13
@grpc/proto-loader@0.7.14
@grpc/proto-loader@0.7.15
@grpc/proto-loader@0.7.2
@grpc/proto-loader@0.7.3
@grpc/proto-loader@0.7.4
@grpc/proto-loader@0.7.5
@grpc/proto-loader@0.7.6
@grpc/proto-loader@0.7.7
@grpc/proto-loader@0.7.9
@grpc/reflection@1.*
@grpc/reflection@1.0.0
@grpc/reflection@1.0.1
@grpc/reflection@1.0.2
@grpc/reflection@1.0.3
@grpc/reflection@1.0.4
grpc-health-check@2.*
grpc-health-check@2.0.0
grpc-health-check@2.0.1
grpc-health-check@2.0.2
grpc-health-check@2.1.0
grpc-tool@1.*
grpc-tool@1.13.0
grpc-tools@1.*
grpc-tools@1.11.0
grpc-tools@1.11.2
grpc-tools@1.11.3
grpc-tools@1.12.0
grpc-tools@1.12.1
grpc-tools@1.12.2
grpc-tools@1.12.3
grpc-tools@1.12.4
grpc-tools@1.7.0
grpc-tools@1.7.2
grpc-tools@1.8.0
grpc-tools@1.9.0
grpc-tools@1.9.1
grpc@1.*
grpc@1.14.0
grpc@1.14.1
grpc@1.23.4
grpc@1.24.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126367.json"