@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
### Impact When server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc/grpc-js` users who use the result of `getAuthContext` for authentication. In particular, `@grpc/grpc-js-xds` can both set the `requireClientCertificate` option to `false` and use the return value of `getAuthContext` for RBAC authentication in some configurations. ### Patches This vulenrability is fixed in 1.13.6 and 1.14.5. ### Workarounds `@grpc/grpc-js` users using `getAuthContext` this way can avoid this problem by setting `requireClientCertificate` to `true`. `@grpc/grpc-js-xds` users using RBAC can avoid this by setting the `require_client_certificate` field to `true` in the DownstreamTlsContext in the xDS configuration.
GHSA-m9gg-hp2v-232j
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-m9gg-hp2v-232j
@grpc/grpc-js
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.13.6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
@grpc/grpc-js
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.14.5
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.6"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"purl": "pkg:npm/%40grpc/grpc-js",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m9gg-hp2v-232j/GHSA-m9gg-hp2v-232j.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.5"
}
]
}
],
"package": {
"name": "@grpc/grpc-js",
"purl": "pkg:npm/%40grpc/grpc-js",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m9gg-hp2v-232j/GHSA-m9gg-hp2v-232j.json"
}
}
]- Related CVEs
- CVE-2026-101916
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #39267 · Revision 1
- Added to Heist Feed
- Publisher date