EUVD-2026-88476
GHSA-m9gg-hp2v-232j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable with no auth (AV:N/PR:N); AC:H because it needs requireClientCertificate=false plus app reliance on getAuthContext; C:H/I:H from unauthorized access, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6Blast Radius
ecosystem impact- 64 npm packages depend on @grpc/grpc-js (24 direct, 40 indirect)
Ecosystem-wide dependent count for version 1.14.0.
DescriptionCVE.org
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
Articles & Coverage 1
AnalysisAI
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a @grpc/grpc-js server (< 1.13.6 or < 1.14.5) configured for TLS with server credentials setting requireClientCertificate to false, AND the application (or @grpc/grpc-js-xds with RBAC authentication enabled) must consume the value returned by getAuthContext / the ssl peer certificate to make an authorization decision. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor/NVD vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (base 7.4, High) is internally consistent with the description: network-reachable (AV:N), no privileges needed (PR:N) because the flaw is in how peer-certificate authorization state is surfaced, but AC:H correctly reflects that exploitation depends on a specific mTLS configuration (requireClientCertificate=false) AND on the application actually consuming getAuthContext for an authorization decision. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.14.5 and 1.13.6 - upgrade @grpc/grpc-js to at least 1.14.5 (or 1.13.6 on the 1.13.x line), the releases containing the fixes shown in commits 2a84ec8b01b9db68ed9d2b117a53a81449edb8ee and b4e0079c6d22a2adedfcac748e0bc083f783bc7c and the tag @grpc/grpc-js@1.14.5, and bring @grpc/grpc-js-xds to a matching patched version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all services embedding @grpc/grpc-js and @grpc/grpc-js-xds, identify instances running versions earlier than 1.13.6 (1.13.x line) or earlier than 1.14.5 (1.14.x and later), and flag any configuration where requireClientCertificate is set to false while the application derives access decisions from getAuthContext or uses xDS RBAC authentication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today