CVE-2026-101914

Katalog CVE

CVSS 6.5 · Medium EPSS 0,25%

Kerentanan Partial String Comparison. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-187: Partial String Comparison
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4
• https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f
• https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1
• https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2