CVE-2026-126367

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js-xds versions prior to 1.13.2 @grpc/grpc-js-xds versions 1.14.0 through 1.14.1

Description In the SafeRegexValueMatcher and PathSafeRegexValueMatcher components, start and end anchors are added to supplied top-level alternations without proper grouping. This causes the regular expression to match prefixes, substrings, or suffixes instead of the complete intended values. This behavior affects route selection, xDS credential identity matching, and RBAC rules involving url path, principal names, server names, and header rules. Consequently, an ALLOW policy using alternation may incorrectly grant access to methods, certificate identities, or header values outside the intended set, while DENY policies may become broader. The issue occurs because the anchors bind only to the first and last branches of the alternation rather than the entire group.

Recommendations Update @grpc/grpc-js-xds to version 1.13.2. Update @grpc/grpc-js-xds to version 1.14.2.