CVE-2026-101914 in grpc-js
Summary
by MITRE • 09/28/2026
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in @grpc/grpc-js prior to versions 1.13.1 and 1.14.1 represents a critical logic flaw within the Role-Based Access Control implementation, specifically affecting how method names are matched against access policies when case-insensitive matching is enabled. gRPC relies on strict service definitions where each RPC method has specific security requirements defined by RBAC rules. The core issue stems from the path matcher algorithm using prefix comparison rather than exact equality comparison for these method names under certain configuration conditions. This deviation from standard string matching behavior creates a scenario where authorization decisions are based on incomplete or overly broad pattern matches, fundamentally undermining the integrity of access control mechanisms designed to restrict user permissions.
From a technical perspective, the flaw manifests when two distinct service methods exist such that one method name is a prefix of another, and these methods have different RBAC rules assigned to them. For instance, if there are methods named /Service/Read and /Service/ReadWrite, and case-insensitive matching is active, a request targeting the longer path might incorrectly match the rule associated with the shorter prefix. This occurs because the matcher checks if the requested method starts with the defined pattern rather than verifying that it matches exactly. Consequently, an attacker or unauthorized user could exploit this by crafting requests to the more specific endpoint while inadvertently triggering authorization rules intended for a less privileged or entirely different endpoint. This leads to incorrect authorization decisions where access is either granted when it should be denied or potentially restricted incorrectly depending on the rule configuration.
The operational impact of this vulnerability is significant, particularly in environments relying heavily on gRPC for microservices communication with strict security boundaries. It allows for potential privilege escalation if a less privileged user can invoke methods intended for higher-privileged roles by leveraging the prefix match behavior. Conversely, it could also lead to denial of service or functional errors if legitimate requests are blocked due to conflicting rule matches. This type of logic error is particularly dangerous because it does not involve buffer overflows or memory corruption but rather a fundamental misunderstanding of string comparison semantics in security-critical code paths. It violates the principle of least privilege by allowing access beyond what was explicitly configured for specific endpoints, thereby weakening the overall security posture of distributed systems built on gRPC.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if interpreted broadly as improper enforcement of access control logic. More specifically, it falls under CWE-613 Insufficient Session Expiration or CWE-862 Missing Authorization when considering the failure to correctly enforce RBAC policies due to flawed matching logic. In terms of MITRE ATT&CK framework, this relates to techniques involving privilege escalation and unauthorized access through misconfigured security controls. Attackers can leverage such flaws in internal service-to-service communication where trust assumptions might be weaker or monitoring less rigorous than at external boundaries.
To mitigate this risk, organizations must immediately upgrade @grpc/grpc-js to version 1.13.1 or later for projects using the older branch, and version 1.14.1 or later for those on the newer development track. These releases correct the path matcher logic to ensure that case-insensitive matching still performs exact equality comparisons rather than prefix matches. Additionally, developers should review their RBAC configurations to identify any service methods with overlapping name prefixes that might have been affected by this flaw in previous versions. Implementing strict input validation and ensuring that all gRPC method names are uniquely distinguishable even under case variations can provide defense-in-depth against similar logic errors. Regular security audits of access control implementations, particularly those involving string matching algorithms, are recommended to prevent recurrence of such vulnerabilities.