CVE-2026-101914: CWE-187: Partial String Comparison in grpc grpc-node
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
AI Analysis
Technical Summary
The grpc-node package's RBAC implementation used a prefix comparison for matching method names when case-insensitive matching was enabled, rather than an exact equality check. This allowed a request to a longer method name to incorrectly match the access rules of a shorter method name that prefixes it, potentially granting unauthorized access. This vulnerability affects versions prior to 1.13.1 and versions from 1.14.0 up to but not including 1.14.1. The flaw is addressed by correcting the matcher to perform exact equality comparisons in versions 1.13.1 and 1.14.1.
Potential Impact
Incorrect authorization decisions may occur, allowing a request to a longer method name to be authorized under the access rules of a shorter, prefix method. This can lead to unauthorized access to services or operations that should have different access controls. The impact is limited to confidentiality and integrity as per the CVSS vector, with no availability impact.
Mitigation Recommendations
Upgrade grpc-node to version 1.13.1 or later, or to version 1.14.1 or later, where the issue is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-101914: CWE-187: Partial String Comparison in grpc grpc-node
Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
CVSS v3.1
Score 6.5medium
Affected software
grpc
grpc-node
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The grpc-node package's RBAC implementation used a prefix comparison for matching method names when case-insensitive matching was enabled, rather than an exact equality check. This allowed a request to a longer method name to incorrectly match the access rules of a shorter method name that prefixes it, potentially granting unauthorized access. This vulnerability affects versions prior to 1.13.1 and versions from 1.14.0 up to but not including 1.14.1. The flaw is addressed by correcting the matcher to perform exact equality comparisons in versions 1.13.1 and 1.14.1.
Potential Impact
Incorrect authorization decisions may occur, allowing a request to a longer method name to be authorized under the access rules of a shorter, prefix method. This can lead to unauthorized access to services or operations that should have different access controls. The impact is limited to confidentiality and integrity as per the CVSS vector, with no availability impact.
Mitigation Recommendations
Upgrade grpc-node to version 1.13.1 or later, or to version 1.14.1 or later, where the issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-28T15:55:37.907Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abac483f7a7c541061ff40c
Added to database: 09/28/2026, 19:48:19 UTC
Last enriched: 09/28/2026, 20:02:47 UTC
Last updated: 09/29/2026, 02:39:14 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.