Is CVE-2026-101916 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101916 being exploited in the wild.

How severe is CVE-2026-101916?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

Google @Grpc/Grpc-Js before 1.13.6, before 1.14.5; Google @Grpc/Grpc-Js-Xds affected versions unspecified; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.13.6.

Is there a fix for CVE-2026-101916?

Yes. @grpc/grpc-js (npm): upgrade to 1.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101916 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101916?

Check whether you run Google @Grpc/Grpc-Js, Google @Grpc/Grpc-Js-Xds or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101916: @grpc/grpc-js authentication context validation bypass

CVE-2026-101916 · Severity: high · CVSS 7.4 · Published 2026-09-28

@grpc/grpc-js is a JavaScript implementation of the gRPC remote procedure call framework used by services that need secure communication between applications. Prior to versions 1.13.6 and 1.14.5, the library incorrectly treats unauthorized client certificates as authorized when server credential validation is not strictly enforced, allowing attackers to bypass authentication and potentially gain unauthorized access to protected services. Applications using gRPC with client certificate authentication are at risk of accepting invalid credentials.

Technologies: @grpc/grpc-js (npm). Vendors: Google, npm.

Quick answers

Is CVE-2026-101916 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101916 being exploited in the wild.
How severe is CVE-2026-101916?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: Google @Grpc/Grpc-Js before 1.13.6, before 1.14.5; Google @Grpc/Grpc-Js-Xds affected versions unspecified; @grpc/grpc-js (npm) SEMVER:introduced=0,fixed=1.13.6.
Is there a fix for CVE-2026-101916?: Yes. @grpc/grpc-js (npm): upgrade to 1.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101916 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101916?: Check whether you run Google @Grpc/Grpc-Js, Google @Grpc/Grpc-Js-Xds or @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@grpc/grpc-js (npm): upgrade to 1.13.6 or later
```
npm install @grpc/grpc-js@1.13.6
```

Technical details

The getAuthContext function in @grpc/grpc-js fails to distinguish between authorized and unauthorized peer certificates when requireClientCertificate is set to false, allowing unauthorized certificates to be treated as valid. This is a validation logic flaw in the server-interceptors and transport layers that affects certificate-based authentication. The vulnerability is exploitable over the network when applications rely on the authentication context to enforce certificate validation, and it has been patched in versions 1.13.6 and 1.14.5.

Affected products

Google @grpc/grpc-js before 1.13.6, before 1.14.5
Google @grpc/grpc-js-xds affected versions unspecified

Identifiers

CVE-2026-101916
GHSA-m9gg-hp2v-232j

Timeline

2026-09-28: disclosed: Public disclosure via NVD
2026: patched: Fixed in @grpc/grpc-js versions 1.13.6 and 1.14.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.