CVE-2026-101914: grpc grpc-node Partial String Comparison

Vulnerability summary

CVE-2026-101914 is a medium (CVSS 6.5) Partial String Comparison vulnerability in grpc grpc-node. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.

Timeline

1. 28-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

• CWE-187Partial String ComparisonThe product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.