Search: CVE-2026-101916

CVE-2026-101916 is a high-severity vulnerability in grpc-node's @grpc/grpc-js library where improper certificate validation occurs. Versions prior to 1.13.6 and between 1.14.0 and before 1.14.5 do not properly distinguish authorized from unauthorized peer certificates when server credentials have requireClientCertificate set to false. This can cause applications to mistakenly treat unauthorized certificates as authorized, leading to improper authentication. The issue also affects @grpc/grpc-js-xds when RBAC authentication is enabled. The vulnerability is fixed in versions 1.13.6 and 1.14.5.