CVE-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

EUVD-2026-88476

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use th...

CVE-2026-101916

The @grpc/grpc-js library (versions prior to 1.13.6 and 1.14.5 ) contains a vulnerability where the getAuthContext function fails to distinguish between authorized and unauthorized peer certificates. This occurs specifically when server credentials have requireClientCertificate set to false . If ...