CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
- Record
CVE-2026-101916- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-88476
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
- Record
EUVD-2026-88476- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m9gg-hp2v-232j
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Impact
When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the result of getAuthContext for authentication.
In particular, @grpc/grpc-js-xds can both set the requireClientCertificate option to false and use the return value of getAuthContext for RBAC authentication in some configurations.
Patches
This vulenrability is fixed in 1.13.6 and 1.14.5.
Workarounds
@grpc/grpc-js users using getAuthContext this way can avoid this problem by setting requireClientCertificate to true. @grpc/grpc-js-xds users using RBAC can avoid this by setting the require_client_certificate field to true in the DownstreamTlsContext in the xDS configuration.
- Record
GHSA-m9gg-hp2v-232j- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
- Record
CVE-2026-101916- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
- Record
CVE-2026-101916- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-m9gg-hp2v-232j
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Impact
When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the result of getAuthContext for authentication.
In particular, @grpc/grpc-js-xds can both set the requireClientCertificate option to false and use the return value of getAuthContext for RBAC authentication in some configurations.
Patches
This vulenrability is fixed in 1.13.6 and 1.14.5.
Workarounds
@grpc/grpc-js users using getAuthContext this way can avoid this problem by setting requireClientCertificate to true. @grpc/grpc-js-xds users using RBAC can avoid this by setting the require_client_certificate field to true in the DownstreamTlsContext in the xDS configuration.
- Record
GHSA-m9gg-hp2v-232j- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1792603525 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 0.6.9-tuxcare.1.
- Record
CLSA-2026-1792603525- Updated
- 2026-11-02
OSVCLSA-2026-1792745507 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.3.8-tuxcare.1.
- Record
CLSA-2026-1792745507- Updated
- 2026-11-02
OSVCLSA-2026-1792745535 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.9.16-tuxcare.1.
- Record
CLSA-2026-1792745535- Updated
- 2026-11-02
OSVCLSA-2026-1792745716 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.1.
- Record
CLSA-2026-1792745716- Updated
- 2026-11-02
OSVCLSA-2026-1792746952 No score
TuxCare security update for @grpc/grpc-js (2 CVEs)
TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.14.4-tuxcare.1.
- Record
CLSA-2026-1792746952- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-101916 No score
CVE-2026-101916 in @grpc/grpc-js - Patched by Root
Root has patched CVE-2026-101916 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-101916- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grpc/grpc-jsnpm |
before 1.13.6 | 1.13.6 |
@grpc/grpc-jsnpm |
1.14.0 up to 1.14.5 | 1.14.5 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
0.6.9-tuxcare.0 up to 0.6.9-tuxcare.1, plus listed versions 0.6.9 |
0.6.9-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.3.8-tuxcare.0 up to 1.3.8-tuxcare.1, plus listed versions 1.3.8 |
1.3.8-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.9.16-tuxcare.0 up to 1.9.16-tuxcare.1, plus listed versions 1.9.16 |
1.9.16-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.12.6-tuxcare.0 up to 1.12.6-tuxcare.1, plus listed versions 1.12.6 |
1.12.6-tuxcare.1 |
@grpc/grpc-jsTuxCare:npm From an advisory covering 2 CVEs |
1.14.4-tuxcare.0 up to 1.14.4-tuxcare.1, plus listed versions 1.14.4 |
1.14.4-tuxcare.1 |
@grpc/grpc-jsRoot:npm |
before 1.9.15-aikido.1 | 1.9.15-aikido.11.14.4-aikido.11.12.2-aikido.3 |
@rootio/grpc__grpc-jsRoot:npm |
before 1.9.15-root.io.1 | 1.9.15-root.io.11.14.4-root.io.11.12.2-root.io.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-101916 is a high vulnerability (CVSS 7.4) in Grpc Grpc-node, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 12th percentile. Fixed in @grpc/grpc-js 1.13.6.
References
github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
nvd.nist.gov/vuln/detail/CVE-2026-101916