CVE-2026-128065

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions 1.14.0 through 1.14.1

Description In the XdsServer component of @grpc/grpc-js-xds, the system may acknowledge Route and VirtualHost resources but fail to apply their RBACPerRoute override configurations. This occurs because the override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC (Role-Based Access Control) is enabled and a trusted xDS control plane provides a broad top-level ALLOW policy with a stricter matching override, affected servers may evaluate RPCs under the broad policy and accept requests that should be denied.

Recommendations Update @grpc/grpc-js to version 1.14.2.