Go to packages list

grpc-grpc-js-xds

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 5 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate3 (100.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting grpc-grpc-js-xds, based on data from OSV.

Vulnerabilities affecting grpc-grpc-js-xds
IDSeveritySummaryAffected versionsPublishedSource
GHSA-gg5j-6742-v827Moderate@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied### Summary `XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy. ### Details ### Override parser lookup uses the override message type `parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` S
  • >= 1.14.0, < 1.14.2
GitHub (opens in a new tab)
GHSA-r7hq-q2xm-6c5mModerate@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation### Summary The StringMatcher/PathMatcher for `safe_regex` builds its RE2 as `^${regex}$` with no surrounding group. Because alternation has the lowest precedence, a pattern `"a|b|c"` compiles to `/^a|b|c$/` -- "starts with a" OR "contains b" OR "ends with c" instead of a full match of the whole value. Configurations with `safe_regex` matchers that use a regex alternation (a natural way to list methods or service identities) therefore apply partial string matches. This impacts route selection, xDS credentials, and RBAC. ### Details `src/matcher.ts`: `SafeRegexValueMatcher` and `PathSafeRege
  • >= 1.14.0, < 1.14.2
  • < 1.13.2
GitHub (opens in a new tab)
GHSA-88h9-xgvx-hvf2Moderate@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication. ### Patches This vulnerability is fixed in 1.13.1 and 1.14.1. ### Workarounds This problem can be avoided by enabling case-sensitive path matching.
  • < 1.13.1
  • >= 1.14.0, < 1.14.1
GitHub (opens in a new tab)
  • GHSA-gg5j-6742-v827Moderate
    @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
    • >= 1.14.0, < 1.14.2
    GitHub (opens in a new tab)

    ### Summary `XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy. ### Details ### Override parser lookup uses the override message type `parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` S

    CVE: CVE-2026-128065

  • GHSA-r7hq-q2xm-6c5mModerate
    @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
    • >= 1.14.0, < 1.14.2
    • < 1.13.2
    GitHub (opens in a new tab)

    ### Summary The StringMatcher/PathMatcher for `safe_regex` builds its RE2 as `^${regex}$` with no surrounding group. Because alternation has the lowest precedence, a pattern `"a|b|c"` compiles to `/^a|b|c$/` -- "starts with a" OR "contains b" OR "ends with c" instead of a full match of the whole value. Configurations with `safe_regex` matchers that use a regex alternation (a natural way to list methods or service identities) therefore apply partial string matches. This impacts route selection, xDS credentials, and RBAC. ### Details `src/matcher.ts`: `SafeRegexValueMatcher` and `PathSafeRege

    CVE: CVE-2026-126367

  • GHSA-88h9-xgvx-hvf2Moderate
    @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
    • < 1.13.1
    • >= 1.14.0, < 1.14.1
    GitHub (opens in a new tab)

    ### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication. ### Patches This vulnerability is fixed in 1.13.1 and 1.14.1. ### Workarounds This problem can be avoided by enabling case-sensitive path matching.

    CVE: CVE-2026-101914

Showing 1-3 of 3 vulnerabilities