{"id":"EUVD-2026-88464","enisaUuid":"ef416c78-6ea7-338e-b912-db3f62958fb1","description":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method\u0027s rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.","datePublished":"Sep 28, 2026, 7:36:55 PM","dateUpdated":"Sep 29, 2026, 7:21:17 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2\nhttps://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4\nhttps://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f\nhttps://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1\n","aliases":"CVE-2026-101914\nGHSA-88h9-xgvx-hvf2\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"0ba2d71c-9830-36ac-ac22-3278ccae99e1","product":{"name":"grpc-node","vendor":{"name":"grpc"}},"product_version":"1.14.0, \u003c 1.14.1"},{"id":"4dafd0b2-0db9-3192-ba86-565b67d8e81c","product":{"name":"grpc-node","vendor":{"name":"grpc"}},"product_version":"\u003c 1.13.1"}],"enisaIdVendor":[{"id":"3ef74933-5257-331a-a72c-390960415639","vendor":{"name":"grpc"}}],"enisaIdVulnerability":[{"id":"1025c66a-d156-36ea-993a-74426906f6d4","vulnerability":{"id":"GHSA-88h9-xgvx-hvf2","description":"@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches","datePublished":"Sep 28, 2026, 7:43:51 PM","dateUpdated":"Sep 28, 2026, 7:46:29 PM","baseScore":0.0,"references":"https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2\nhttps://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4\nhttps://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f\nhttps://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75\nhttps://github.com/grpc/grpc-node\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1\n","enisa_id":"EUVD-2026-88464\n","aliases":"CVE-2026-101914\nGHSA-88h9-xgvx-hvf2\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9d02f008-0459-398e-86a5-73807b6419fb","vulnerability":{"id":"CVE-2026-101914","description":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method\u0027s rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.","datePublished":"Sep 28, 2026, 7:36:55 PM","dateUpdated":"Sep 29, 2026, 7:21:17 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2\nhttps://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4\nhttps://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f\nhttps://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1\n","enisa_id":"EUVD-2026-88464\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Oct 29, 2026, 7:15:20 AM","vulnerabilityProduct":[{"id":"10a3f2bf-4766-32ac-8ed6-3454ff5d3d27","product":{"name":"grpc-node","vendor":{"name":"grpc"}},"product_version":"\u003c 1.13.1"},{"id":"5292d3da-8b0f-3c67-8a73-d4d0801f5e2d","product":{"name":"grpc-node","vendor":{"name":"grpc"}},"product_version":"1.14.0, \u003c 1.14.1"}],"vulnerabilityVendor":[{"id":"3f4a9611-9b05-3b54-8d2f-0fc30abfd5f1","vendor":{"name":"grpc"}}]}}],"enisaIdAdvisory":[]}