Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-128065 EUVD-2026-124776GHSA-gg5j-6742-v827

@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

Affected products

VendorProductAffectedFixed
grpc grpc-node >= 1.14.0, < 1.14.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @grpc/grpc-js-xds >= 1.14.0, < 1.14.2 1.14.2 GHSA-gg5j-6742-v827

References