CVE-2026-101914: @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication.
References
- github.com/advisories/GHSA-88h9-xgvx-hvf2
- github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4
- github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f
- github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
- github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1
- github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2
- nvd.nist.gov/vuln/detail/CVE-2026-101914
Code Behaviors & Features
Detect and mitigate CVE-2026-101914 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →