CVE-2026-1263674.8MediumCWE-625

CVE-2026-126367: @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

grpc · grpc-node

Affected: grpc-node · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

5th percentile

050100

Higher than 5% of scored CVEs

4.8MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

grpc · grpc-node< 1.13.2; >= 1.14.0, < 1.14.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Permissive Regular Expression · Input Validation and Logic
Vendor: grpc
Published: November 2026
Band: Unlikely (under 1%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-126367 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.