@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-128065 · CVE overview and exploitation status

EUVD-2026-124776

GHSA-gg5j-6742-v827

cve-program · CVE-2026-128065

• https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827
• https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
• https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]

euvd · EUVD-2026-124776

• https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827
• https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
• https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]

nvd · CVE-2026-128065

• https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
• https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]
• https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827

osv · GHSA-gg5j-6742-v827

• https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827
• https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
• https://github.com/grpc/grpc-node
• https://github.com/grpc/grpc-node/releases/tag/@grpc/[email protected]

• @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACP… · Advisory content revised · 15 Nov 2026
• @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied · Newly collected advisory · 13 Nov 2026
• @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied · Newly collected advisory · 13 Nov 2026