CVE-2026-128065

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is n...

@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

Summary XdsServer in @grpc/grpc-js-xds does not apply RBACPerRoute overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, XdsServer ACKs the resources but evaluates the RPC under the top-level polic...

CVE-2026-128065 @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is n...

CVE-2026-128065

The @grpc/grpc-js-xds component within @grpc/grpc-js versions 1.14.0 through 1.14.1 fails to apply RBACPerRoute override configurations for Route and VirtualHost resources. The root causes include an unregistered override parser message type, storing override maps under a type URL instead of the ...