Three @grpc/grpc-js Vulnerabilities: Authentication Bypass, Information Disclosure, and RBAC Matching Flaw

What happened

Three distinct vulnerabilities were disclosed in @grpc/grpc-js and the related @grpc/grpc-js-xds package. CVE-2026-101916 concerns the getAuthContext function, which does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false; applications relying on the returned authentication context may treat an unauthorized certificate as authorized. CVE-2026-101915 concerns the server including uncaught error messages from method handlers in the status message sent to clients, which can expose sensitive information if the thrown error contains it. CVE-2026-101914 affects the RBAC exact-path matcher, which performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled; if one method name is a prefix of another and the two have different access rules, a request to the longer method name can incorrectly match the shorter method's rule.

Technical cause

CVE-2026-101916 (CWE-295, Improper Certificate Validation) stems from getAuthContext not differentiating between authorized and unauthorized peer certificates in configurations where requireClientCertificate is set to false; @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled. CVE-2026-101915 (CWE-550, Server-generated Error Message Containing Sensitive Information) occurs because uncaught errors thrown by application method handlers have their error message transmitted to the client in the gRPC status message. CVE-2026-101914 (CWE-187, Partial String Comparison) is caused by the RBAC exact-path matcher using a prefix comparison rather than strict equality when case-insensitive matching is enabled.

Why it matters

These vulnerabilities affect authentication and authorization logic directly. CVE-2026-101916 can lead to applications incorrectly trusting a peer certificate as authorized when it should not be, which is particularly relevant where @grpc/grpc-js-xds is used with RBAC authentication enabled. CVE-2026-101914 can cause RBAC authorization checks to apply the wrong access rule to a request, potentially granting access that should have been restricted. CVE-2026-101915 is a lower-severity issue that can leak sensitive information contained in unhandled error messages to clients.

Who is affected

Applications using @grpc/grpc-js are affected by CVE-2026-101916 and CVE-2026-101915. Applications using @grpc/grpc-js-xds, specifically those with RBAC authentication enabled, are affected by CVE-2026-101914 and can also reach the condition described in CVE-2026-101916.

Affected versions

For CVE-2026-101916 and CVE-2026-101915: @grpc/grpc-js versions in the range >= 1.14.0, < 1.14.5 are affected, as are versions prior to 1.13.6 in the 1.13.x line. For CVE-2026-101914: @grpc/grpc-js-xds version 1.14.0 is affected, as are versions prior to 1.13.1 in the 1.13.x line.

Fixes and mitigation

CVE-2026-101916 and CVE-2026-101915 are fixed in @grpc/grpc-js version 1.14.5 and version 1.13.6. CVE-2026-101914 is fixed in @grpc/grpc-js-xds version 1.14.1 and version 1.13.1.

Recommended action

Update @grpc/grpc-js to version 1.14.5 or 1.13.6 depending on your current release line. Update @grpc/grpc-js-xds to version 1.14.1 or 1.13.1 depending on your current release line. Review application code that relies on getAuthContext for authorization decisions, and review method handler error messages for sensitive content that should not be exposed to clients. If RBAC is used with case-insensitive matching and overlapping method name prefixes, verify that access rules are applied correctly after upgrading.