{"action":"Upgrade @grpc/grpc-js to 1.13.6 or later.","affected":[{"fixed":"1.13.6","introduced":"0"},{"fixed":"1.14.5","introduced":"1.14.0"}],"component":"@grpc/grpc-js","cve_ids":["CVE-2026-101916"],"ecosystem":"npm","epss":0.00215,"exploited":false,"fixed_versions":["1.13.6","1.14.5"],"ghsa_id":"GHSA-m9gg-hp2v-232j","id":"tcs_01M5KG0CX75C8NZQTMMY1QNBK9","modified_at":"2026-09-30T15:45:30.357039902Z","published_at":"2026-09-30T15:35:53Z","references":["https://osv.dev/vulnerability/GHSA-m9gg-hp2v-232j","https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j","https://nvd.nist.gov/vuln/detail/CVE-2026-101916","https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee","https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c","https://github.com/grpc/grpc-node","https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-m9gg-hp2v-232j","url":"https://osv.dev/vulnerability/GHSA-m9gg-hp2v-232j"}],"summary":"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized"}