CVE-2026-101916High· 7.4▾ Twilight@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.2%
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@grpc/grpc-js < 1.13.6@grpc/grpc-js >= 1.14.0, < 1.14.5Patched in:
@grpc/grpc-js 1.13.6@grpc/grpc-js 1.14.5Source: https://github.com/advisories/GHSA-m9gg-hp2v-232j
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101915Low· 3.7@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
CVE-2026-109383High· 7.4undici is an HTTP client library for Node.js
CVE-2026-101914Medium· 6.5@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
CVE-2026-84445High· 8.7gRPC-Go is the Go language implementation of gRPC
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)