CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
| CWE | CWE-295 |
| Vendor | grpc |
| Product | grpc-node |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for grpc grpc-node
Be the first to know when new high vulnerabilities affecting grpc grpc-node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
grpc / grpc-node
< 1.13.6 >= 1.14.0, < 1.14.5
References
github.com: https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j github.com: https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee github.com: https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c github.com: https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5