CVE-2026-126367

The @grpc/grpc-js-xds library (specifically SafeRegexValueMatcher and PathSafeRegexValueMatcher) contains a logic error in how it handles regular expression alternations. The component fails to group top-level alternations when applying start and end anchors, causing expressions like a|b|c to be ...