https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T15:28:09.873767+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-101914 fkie_cve-2026-101914 2026-09-29T15:28:09.886775+00:00

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

 https://vulnerability.circl.lu/vuln/ghsa-88h9-xgvx-hvf2 GHSA-88h9-xgvx-hvf2 — @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches 2026-09-29T15:28:09.886867+00:00

Affected: npm: @grpc/grpc-js-xds

### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication.

### Patches

This vulnerability is fixed in 1.13.1 and 1.14.1.

### Workarounds This problem can be avoided by enabling case-sensitive path matching.