Grpc Node
Monthly
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.