EUVD-2026-88464
GHSA-88h9-xgvx-hvf2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-reachable unauthenticated request (AV:N/PR:N) but multiple config/naming preconditions justify AC:H; bypassing an access-control rule yields I:H with limited C:L and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
AnalysisAI
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) the application uses the @grpc/grpc-js-xds package with xDS-driven RBAC for authorization; (2) case-insensitive path matching is enabled (the vendor workaround is to switch to case-sensitive matching, indicating case-insensitive is a selectable non-mandatory mode); and (3) the service defines two methods where one method name is a string prefix of another AND those methods carry different access rules. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional authorization-bypass issue rather than a high-severity mass-exploitation risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @grpc/grpc-js-xds to 1.13.1 (for the 1.13.x and earlier lines) or 1.14.1 (for the 1.14.x line), which replace the incorrect prefix comparison with a strict equality check (commits 6cf64b596da03f1942a6b168998f0670217a99c4 and a6c5b31180cc8cea94d0a5ea215ce31a49e0409f; advisories at https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-187 – Partial String Comparison
View allShare
External POC / Exploit Code
Leaving vuln.today