CVE-2026-101916

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.13.6 @grpc/grpc-js versions prior to 1.14.5

Description The getAuthContext() function fails to distinguish between authorized and unauthorized peer certificates when server credentials have requireClientCertificate set to false. This can lead to improper authentication if applications rely on the returned authentication context, treating unauthorized certificates as authorized. This condition can also occur in @grpc/grpc-js-xds when Role-Based Access Control (RBAC) authentication is enabled in affected configurations.

Recommendations Update @grpc/grpc-js to version 1.13.6. Update @grpc/grpc-js to version 1.14.5.