Feed/CVE-2026-101914
CVE-2026-101914MEDIUMCVSS 6.5

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

Published Sep 28, 2026·Updated Sep 28, 2026

NVD Description

### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication. ### Patches This vulnerability is fixed in 1.13.1 and 1.14.1. ### Workarounds This problem can be avoided by enabling case-sensitive path matching.

Affected Packages (1)

@grpc/grpc-js-xdsNPM
Fixed in 1.13.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free