gRPC JavaScript Implementation Vulnerability in @grpc/grpc-js by Google

CVE-2026-128065

What is CVE-2026-128065?

A vulnerability exists in the JavaScript implementation of gRPC where the XdsServer component can erroneously acknowledge resource configurations while failing to enforce Role-Based Access Control (RBAC) overrides. Specifically, the override parser isn't configured correctly under the expected message type, which could lead to improper evaluations of RPCs based on overly permissive policies. When experimental RBAC is enabled, this can allow unauthorized requests, creating significant security risks. This issue has been addressed in version 1.14.2 of @grpc/grpc-js-xds.

References