Apache Thrift Node.js: Denial of service via unbounded loop in TJSONProtocol

Summary

The Node.js bindings of Apache Thrift trust a container size declared by the remote peer in TJSONProtocol and use it as an unbounded loop bound. A remote attacker can send crafted input to a Node.js service that uses Thrift and cause a denial of service. No privileges or user interaction are required, but the attack depends on the deployment conditions.

Affected

• Apache Thrift before 0.25.0, Node.js bindings (npm package thrift)
• The CVE record does not name a specific npm version range.

Fixed in

• Upgrade to Apache Thrift 0.25.0 or later.

Workaround

Unknown. No vendor workaround is documented.

• Until patched, restrict network access to Node.js Thrift services (for example with firewalls or access controls).

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
• EPSS score 0.00426 (low).

Our recommendation

• Check whether any Node.js application uses the Thrift npm package and accepts untrusted network input.
• Upgrade affected installations to Apache Thrift 0.25.0 or later.
• If an upgrade is not possible immediately, restrict who can reach the service.
• Monitor the service for crashes and high resource consumption.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache mailing list thread 1 lists.apache.org
• Apache mailing list thread 2 lists.apache.org
• OSV: BIT-thrift-2026-94645 osv.dev
• Ubuntu security notice CVE-2026-94645 ubuntu.com
• Vulners NVD mirror CVE-2026-94645 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:25.