Most recent entries from all

CLEANSTART-2026-AS30225 — @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Affected: CleanStart: langfuse

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

fkie_cve-2026-101916

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.

GHSA-m9gg-hp2v-232j — @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were autho…

Affected: npm: @grpc/grpc-js

### Impact When server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc/grpc-js` users who use the result of `getAuthContext` for authentication.

In particular, `@grpc/grpc-js-xds` can both set the `requireClientCertificate` option to `false` and use the return value of `getAuthContext` for RBAC authentication in some configurations.

### Patches

This vulenrability is fixed in 1.13.6 and 1.14.5.

### Workarounds `@grpc/grpc-js` users using `getAuthContext` this way can avoid this problem by setting `requireClientCertificate` to `true`. `@grpc/grpc-js-xds` users using RBAC can avoid this by setting the `require_client_certificate` field to `true` in the DownstreamTlsContext in the xDS configuration.

RHSA-2026:80603 — Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector vm2: vm2 before 3.11.7 Remote Code Execution via require.external vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test vm2: vm2 before 3.11.7 Sandbox Escape via CLI require vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix vm2: vm2 before 3.11.6 Process-wide State Exposure via os…