CVE-2026-128065

### Summary `XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy. ### Details ### Override parser lookup uses the override message type `parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257 `setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173 The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override. ### Override maps are keyed by type URL instead of filter name `overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`. Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L99-L102 Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L169-L174 Route overrides are later looked up by their `typed_per_filter_config` key, which is the `HttpFilter.name`. An ordinary key such as rbac therefore misses the stored map. ### VirtualHost overrides are not read `handleRouteConfigurationResource()` in server.ts:225-249 reads `route.typed_per