CVE-2026-126367
Received Received - Intake

ReDoS in @grpc/grpc-js XDS Regex Matchers

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126367

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
grpc grpc-js 1.14.2
grpc grpc-js to 1.13.2 (inc)
grpc grpc-js From 1.14.0 (inc) to 1.14.1 (inc)
grpc grpc-js to 1.14.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @grpc/grpc-js-xds package versions below 1.13.2 and between 1.14.0 to 1.14.1. It involves the safe_regex matcher incorrectly applying partial string matching for patterns containing alternation (e.g., 'a|b|c'). Instead of matching the entire string, the regex anchors bind only to the first and last branches of the alternation, causing unintended partial matches.

Detection Guidance

Check the installed version of @grpc/grpc-js-xds using npm list @grpc/grpc-js-xds. If the version is between 1.14.0 and 1.14.1 or below 1.13.2, the system is vulnerable.

Impact Analysis

This flaw can lead to incorrect authorization decisions. For example, an ALLOW rule with a pattern like '/acme.Users/GetUser|/acme.Users/ListUsers' might incorrectly permit '/acme.Users/GetUserSecrets'. Similarly, a DENY rule could become broader than intended, affecting route selection, xDS credentials, and RBAC rules.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure by allowing partial string matches in authorization rules. For GDPR, this may violate principles of data protection by design and default (Article 25) if unauthorized access occurs. For HIPAA, it could compromise the integrity and confidentiality of protected health information if access controls are bypassed due to overly permissive regex matching.

Mitigation Strategies

Upgrade @grpc/grpc-js-xds to version 1.13.2 or 1.14.2 or later. Verify the upgrade by running npm list @grpc/grpc-js-xds again.

  • Review RBAC, route selection, and credential matching rules to ensure alternation patterns are correctly configured after the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...