@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches — GHSA-88H9-XGVX-HVF2

Summary

### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication. ### Patches This…

Timeline

Published by source

2026-09-28

Risk context

• Reported severity or threat level: medium.
• Reported CVSS score: 6.5 out of 10.
• Review exposure for the affected product or family: npm: @grpc/grpc-js-xds.

Product

npm: @grpc/grpc-js-xds

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-88H9-XGVX-HVF2

Source

GitHub

Vendor

GitHub

Published by source

2026-09-28

Last source activity

2026-09-28

Additional identifiers

CVE-2026-101914

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.