CVE-2026-101916

{
  "etk_id": "ETK-2026-100",
  "cve_id": "CVE-2026-101916",
  "display_id": "CVE-2026-101916",
  "ghsa_id": "GHSA-m9gg-hp2v-232j",
  "euvd_id": "EUVD-2026-88476",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper certificate authentication in @grpc/grpc-js",
  "summary": "Affected @grpc/grpc-js deployments can misclassify an untrusted peer certificate when client certificates are not required and the application uses getAuthContext for access decisions. An attacker may thereby be accepted by authentication or RBAC checks in configurations meeting those conditions, including some @grpc/grpc-js-xds deployments.",
  "mitigation": "Upgrade @grpc/grpc-js to 1.13.6 or 1.14.5. Until upgraded, require client certificates; for xDS RBAC, set require_client_certificate to true in the DownstreamTlsContext configuration.",
  "vendor": "npm",
  "product": "npm:@grpc/grpc-js",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.13.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.13.6"
      ],
      "package_name": "@grpc/grpc-js",
      "purl": "pkg:npm/@grpc/grpc-js"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.14.0, < 1.14.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.14.5"
      ],
      "package_name": "@grpc/grpc-js",
      "purl": "pkg:npm/@grpc/grpc-js"
    }
  ],
  "cwes": [
    295
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1026,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 24.009885316666665,
  "t0_at": "2026-09-28T20:01:53.640000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T19:14:55.707714+00:00",
      "days": 1.967385042986111,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T20:01:53.640000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-28T20:01:53.640000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T20:01:53.640000+00:00",
      "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"
    }
  }
}