GHSA-m9gg-hp2v-232jPublished
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-101916 · CVE overview and exploitation status
cve-program · CVE-2026-101916
- https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
- https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
- https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
euvd · EUVD-2026-88476
- https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
- https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
- https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
nvd · CVE-2026-101916
- https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
- https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
- https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
osv · GHSA-m9gg-hp2v-232j
- https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
- https://nvd.nist.gov/vuln/detail/CVE-2026-101916
- https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
- https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
- https://github.com/grpc/grpc-node
- https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
Related changes
Linked by CVE identifier- @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set re… · Advisory content revised · 11 Nov 2026
- @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set re… · Advisory content revised · 7 Nov 2026
- @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set re… · Advisory content revised · 1 Nov 2026