CVE-2026-101914

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.13.1 @grpc/grpc-js versions prior to 1.14.1

Description When case-insensitive matching is enabled, the Role-Based Access Control (RBAC) exact path matcher performs a prefix comparison instead of an equality comparison for method names. If one service method name is a prefix of another and both have different access rules, a request for the longer method may incorrectly match the rule of the shorter method, leading to improper authorization.

Recommendations Update to version 1.13.1. Update to version 1.14.1. Enable case-sensitive path matching to avoid this issue.