{"id":"CVE-2026-101916","title":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon","summary":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-295"],"vendor":"grpc","product":"grpc-node","affected":["grpc-node < 1.13.6","grpc-node >= 1.14.0, < 1.14.5"],"patched":["@grpc/grpc-js 1.13.6","@grpc/grpc-js 1.14.5"],"published":"2026-09-28","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:17:25.083","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101916","references":[{"url":"https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101916.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-101916"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542678"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101916"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101916"},{"url":"https://github.com/advisories/GHSA-m9gg-hp2v-232j"},{"url":"https://access.redhat.com/errata/RHSA-2026:80603"},{"url":"https://access.redhat.com/errata/RHSA-2026:80644"},{"url":"https://access.redhat.com/errata/RHSA-2026:88198"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","npm"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-01T14:54:36.359795Z"},"epss":0.00215,"epssPercentile":0.11855,"aliases":["GHSA-m9gg-hp2v-232j"],"ecosystem":"npm","ingestedAt":"2026-09-28T21:20:54.777Z","slug":"CVE-2026-101916","body":"## Overview\n\n@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-101916)\n\nAffected packages:\n\n- `@grpc/grpc-js < 1.13.6`\n- `@grpc/grpc-js >= 1.14.0, < 1.14.5`\n\nPatched in:\n\n- `@grpc/grpc-js 1.13.6`\n- `@grpc/grpc-js 1.14.5`\n\nSource: https://github.com/advisories/GHSA-m9gg-hp2v-232j\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Build of Podman Desktop, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Dev Spaces, Self-service automation portal 2 · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Build of Podman Desktop, Red Hat OpenShift Dev Spaces, Self-service automation portal 2 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101916.json)\n- **RHSA-2026:80603** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80603)\n- **RHSA-2026:80644** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80644)\n- **RHSA-2026:88198** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88198)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}