AIKIDO-2026-269867
@grpc/grpc-js-xds is vulnerable to Incorrect Authorization
65
Medium Risk
This Affects:
@grpc/grpc-js-xdsTL;DR
The RBAC exact path (method name) matcher in @grpc/grpc-js-xds applies a case-insensitive prefix match instead of an exact match. When one gRPC method name is a prefix of another method name that has a different access rule and case-insensitive matching is enabled, requests to the longer method name incorrectly match the shorter method's rule. This lets an access rule meant for one method apply to a different method, producing improper authentication decisions. The fix compares the fully lowercased value for equality instead of using startsWith.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use case-insensitive RBAC exact-path matching where one method name is a prefix of another method name with a different access rule.
Background info
@grpc/grpc-js-xds is vulnerable to Incorrect Authorization in versions 0.0.1 - 1.13.0 and 1.14.0 - 1.14.0.
How to fix this
Upgrade the @grpc/grpc-js-xds library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.