AIKIDO-2026-593870
@grpc/grpc-js is vulnerable to Improper Certificate Validation
74
High Risk
This Affects:
@grpc/grpc-jsTL;DR
BaseServerInterceptingCall.getAuthContext() in @grpc/grpc-js returns the peer's TLS certificate data for any TLS connection without checking the socket's authorized flag. Servers that create credentials with requireClientCertificate set to false and then rely on getAuthContext for authentication, such as @grpc/grpc-js-xds RBAC policies, cannot tell an unauthorized or self-signed client certificate from an authorized one. This lets an unauthorized client be treated as though it presented a trusted certificate. The fix checks socket.authorized before returning peer certificate data from getAuthContext.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure server credentials with requireClientCertificate set to false while relying on getAuthContext for authentication or RBAC decisions.
Background info
@grpc/grpc-js is vulnerable to Improper Certificate Validation in versions 1.14.0 - 1.14.4.
How to fix this
Upgrade the @grpc/grpc-js library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.