Answer in brief
CVE-2026-126367 records a Medium severity (CVSS 4.8) vulnerability in @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation. The current sources do not mark it as known exploited. The current feed maps grpc/grpc-node (generic), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps grpc/grpc-node (generic), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| grpc/grpc-nodegeneric | <1.13.2 || >=1.14.0 <1.14.2 | 1.13.2, 1.14.2 |
| @grpc/grpc-js-xdsnpm | >=1.14.0,<1.14.2 | 1.14.2 |
| @grpc/grpc-js-xdsnpm | <1.13.2 | 1.13.2 |
| @grpc/grpc-js-xdsnpm | >=1.14.0,<1.14.2 | 1.14.2 |
| @grpc/grpc-js-xdsnpm | <1.13.2 | 1.13.2 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.
Quoted source text, attributed separately from HOL analysis.