Skip to content
OpenAdvisories

Package · npm

@grpc/grpc-js-xds

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.9
    CVE-2026-128065

    @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

    @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override co…

    grpc grpc-node @grpc/grpc-js-xds npm
  • Medium 4.8
    CVE-2026-126367

    @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

    @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without group…

    grpc grpc-node @grpc/grpc-js-xds npm
  • Medium 6.5
    CVE-2026-101914

    @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

    @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensiti…

    grpc grpc-node @grpc/grpc-js-xds npm