Answer in brief
CVE-2026-128065 records a Medium severity (CVSS 6.9) vulnerability in @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied. The current sources do not mark it as known exploited. The current feed maps grpc/grpc-node (generic), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps grpc/grpc-node (generic), @grpc/grpc-js-xds (npm), @grpc/grpc-js-xds (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| grpc/grpc-nodegeneric | >=1.14.0 <1.14.2 | 1.14.2 |
| @grpc/grpc-js-xdsnpm | >=1.14.0,<1.14.2 | 1.14.2 |
| @grpc/grpc-js-xdsnpm | >=1.14.0,<1.14.2 | 1.14.2 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.
Quoted source text, attributed separately from HOL analysis.