Advisories for Npm/@Grpc/Grpc-Js-Xds package

2026

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match instead of an exact match for case-insensitive matches. As a result, if a service has a method with a name that is a prefix of the name of a different method, and they have different access rules, and case-insensitive matching is used, this bug can cause improper authentication.