{"schemaVersion":3,"id":"CVE-2026-101916","aliases":["CGA-33fr-v6q6-x4xm","CGA-8c58-jxxf-rm4r","CGA-gx4x-5r2m-24x7","CGA-m39w-2q66-fj2q","CGA-mpr9-w293-7x6r","CGA-pjfw-5432-mwwj","CGA-r787-4634-363x","CGA-rj4c-g3x7-6f57","GHSA-m9gg-hp2v-232j","CGA-249w-x7j6-3wrj","CGA-38q7-6whf-4774","CGA-3wcg-hfqh-6qxc","CGA-4rpm-9rxw-89w9","CGA-5qvw-wc29-vv37","CGA-5xxw-jm8f-x5xw","CGA-659h-mcxm-rq2j","CGA-65wh-mjvv-6j2v","CGA-66r8-c47q-2f6c","CGA-969g-5hgj-97pm","CGA-cm69-3px7-5mc9","CGA-cr34-fhjv-g5q6","CGA-cwx4-pjm7-c8xm","CGA-f7pg-mg3m-mpv5","CGA-fc24-rvhr-f76v","CGA-fwgw-49mx-26v5","CGA-h34w-3jf8-h3pg","CGA-hj9w-68q6-c6gp","CGA-mhjg-f3m9-vg78","CGA-qj3q-vh8w-4cgp","CGA-r9cm-hjwh-2c8m","CGA-rj7g-8vc3-vppx","CGA-rw89-qv2q-mg5w","CGA-vp3w-chrr-493w","CGA-vxvm-x85w-x6px","CGA-vxwc-r7p5-r87r","CGA-x5qg-h744-h323","CGA-xhxf-25x8-7cw4"],"status":"published","duplicateOf":null,"title":null,"description":"@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.","dates":{"published":"2026-09-28T20:01:53.640Z","modified":"2026-10-01T14:54:55.987Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.4,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":5.6,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.4,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00208,"percentile":0.10258,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-29T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00208,"percentile":0.10258}],"last30":[{"date":"2026-09-29T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00208,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00208,"percentile":0.10258}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-295","name":"Improper Certificate Validation","description":"The product does not validate, or incorrectly validates, a certificate.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/295.html"}],"affected":[{"vendor":"chainguard","product":"azurite","name":"azurite","label":"azurite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/azurite","purlType":"apk","versions":[{"text":"< 3.37.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.37.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.17-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.17-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotstatsuite-supercore","name":"dotstatsuite-supercore","label":"dotstatsuite-supercore","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotstatsuite-supercore","purlType":"apk","versions":[{"text":"< 3.1.0_git20261001-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0_git20261001-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 2.4.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.22-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.22-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.22-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.22-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.225.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4 | < 3.225.11-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.225.11-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentelemetry-auto-instrumentations-node","name":"opentelemetry-auto-instrumentations-node","label":"opentelemetry-auto-instrumentations-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentelemetry-auto-instrumentations-node","purlType":"apk","versions":[{"text":"< 0.80.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.80.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.268.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.268.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zitadel-4-login","name":"zitadel-4-login","label":"zitadel-4-login","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zitadel-4-login","purlType":"apk","versions":[{"text":"< 4.19.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.19.4-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.225.11-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.225.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.11-r4 | < 3.225.11-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.268.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.268.0-r0","eol":null,"hubHref":null},{"vendor":"grpc","product":"grpc-node","name":"grpc-node","label":"grpc-node","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.14.0, < 1.14.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.6 | ≥ 1.14.0, < 1.14.5","eol":null,"hubHref":"/vendor/grpc/grpc-node"},{"vendor":"@grpc","product":"grpc-js","name":"@grpc/grpc-js","label":"grpc-js","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@grpc/grpc-js","purlType":"npm","versions":[{"text":"< 1.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.14.0, < 1.14.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.6 | ≥ 1.14.0, < 1.14.5","eol":null,"hubHref":null}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j","label":"github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee","label":"github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c","label":"github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5","label":"github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101916.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101916.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101916","label":"nvd.nist.gov/vuln/detail/CVE-2026-101916","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/grpc/grpc-node","label":"github.com/grpc/grpc-node","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-28T20:01:53.640Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-01T14:54:55.987Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T21:22:02.595Z","stale":false,"partial":false}}