CVE-2026-101914 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
Attackers can bypass RBAC restrictions in @grpc/grpc-js by exploiting a prefix matching flaw in case-insensitive path matching, gaining unauthorized access to protected methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101914?
CVE-2026-101914 is a medium-severity missing authorization vulnerability in grpc-node, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
Which versions are affected by CVE-2026-101914?
4 open source packages ship an affected version, including @grpc/grpc-js-xds.
| Package | Affected | Fixed in |
|---|---|---|
@grpc/grpc-js-xds npm | All versions | 1.13.1 |
@grpc/grpc-js-xds npm | All versions | 1.13.1 |
@grpc/grpc-js-xds npm | From 1.14.0 | 1.14.1 |
@grpc/grpc-js-xds npm | From 1.14.0 | 1.14.1 |
How do I fix CVE-2026-101914?
Upgrade @grpc/grpc-js-xds to a fixed version for your release line: 1.13.1 or 1.14.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-101914 being exploited?
There is no known exploitation of CVE-2026-101914 in the wild and no public exploit code.
Sources
Also known as GHSA-88h9-xgvx-hvf2.