CVE-2026-101916: @grpc/grpc-js Unauthorized Certificate Handling Vulnerability
Summary
CVE-2026-101916: Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. Affects @grpc/grpc-js across 2 version ranges.
< 1.13.6
>= 1.14.0, < 1.14.5
Fixed in 1.13.6 or 1.14.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @grpc/grpc-js package is a JavaScript implementation of gRPC, a high-performance RPC framework that enables communication between services. It is widely used for building microservices and APIs due to its efficiency and support for multiple programming languages. However, a vulnerability exists in certain configurations that can lead to unauthorized certificates being treated as authorized, compromising the security of applications relying on this package.
Vulnerability Detail
The vulnerability arises when server credentials are created with the 'requireClientCertificate' option set to 'false'. In this scenario, the 'getAuthContext' function fails to differentiate between authorized and unauthorized certificates, potentially allowing unauthorized access. This can lead to improper authentication, especially for users of @grpc/grpc-js-xds who utilize the result of 'getAuthContext' for Role-Based Access Control (RBAC) authentication. The issue is classified under CWE-295, indicating a potential breach of authentication mechanisms.
How To Fix
Latest published version: 1.14.6 as of 23 Oct 2026
npm install @grpc/grpc-js@1.14.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.61.13.6npm install @grpc/grpc-js@1.13.6 -
>= 1.14.0, < 1.14.51.14.5npm install @grpc/grpc-js@1.14.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can set the 'requireClientCertificate' option to 'true' when creating server credentials. For @grpc/grpc-js-xds users, ensure that the 'require_client_certificate' field is set to 'true' in the DownstreamTlsContext within your xDS configuration. Example configuration:
const tlsConfig = {
require_client_certificate: true,
// other TLS settings
};
Conclusion
The @grpc/grpc-js package has a significant vulnerability that can lead to unauthorized access due to improper handling of client certificates. Users are strongly advised to update to the latest patched versions or implement the suggested workarounds to mitigate the risk.
See every vulnerability recorded for @grpc/grpc-js →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to gain access to sensitive resources, leading to data breaches or unauthorized actions within your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just your package-lock.json.
If an immediate update is not possible, implement the recommended workarounds by setting 'requireClientCertificate' to 'true' in your server credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for @grpc/grpc-js.
