CVE-2026-1019146.5MediumCWE-187

CVE-2026-101914: @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

grpc · grpc-node

Affected: grpc-node · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

16th percentile

050100

Higher than 16% of scored CVEs

6.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

grpc · grpc-node< 1.13.1; >= 1.14.0, < 1.14.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Partial String Comparison · Input Validation and Logic
Vendor: grpc
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-101914 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.