EUVD-2026-124775Published
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-126367 · CVE overview and exploitation status
cve-program · CVE-2026-126367
- https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m
- https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1
- https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
euvd · EUVD-2026-124775
- https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m
- https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1
- https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
nvd · CVE-2026-126367
- https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1
- https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
- https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m
osv · GHSA-r7hq-q2xm-6c5m
- https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m
- https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1
- https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43
- https://github.com/grpc/grpc-node
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
- https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
Related changes
Linked by CVE identifier- @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end an… · Advisory content revised · 15 Nov 2026
- @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation · Newly collected advisory · 13 Nov 2026
- @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation · Newly collected advisory · 13 Nov 2026