Threats tagged 'ghsa-r7hq-q2xm-6c5m'

A vulnerability in @grpc/grpc-js-xds safe_regex matchers causes incorrect partial string matching when regex patterns use alternation. This leads to overly permissive matches in route selection, xDS credentials, and RBAC rules, potentially allowing unauthorized access. The issue arises because the regex anchors are applied incorrectly, causing patterns like "a|b|c" to match unintended strings. This affects versions >=1.14.0 <1.14.2 and <1.13.2 and is fixed in 1.14.2 and 1.13.2.