Apache Thrift Node.js bindings: Denial of service via uncaught exception
Summary
Apache Thrift's Node.js bindings (npm package thrift) contain flaws that include an uncaught exception, improper validation of a specified quantity in input, and prototype pollution. The CNA describes a Node.js server that terminates the process on any per-connection error, so a remote client can crash the service. Exploitation requires no authentication or user interaction, but the record does not name a fully confirmed trigger path beyond this availability impact.
Affected
- Apache Thrift before 0.25.0 (Node.js bindings)
Fixed in
- Apache Thrift 0.25.0
Workaround
Unknown. The vendor's stated remedy is the upgrade.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
- No public exploit code has been confirmed (unverified).
Our recommendation
- Identify Node.js services that use Apache Thrift and check the installed version.
- Upgrade to Apache Thrift 0.25.0 or later.
- Regenerate the JavaScript code from the Thrift IDL after the upgrade, as the sibling advisory suggests (verify against the Apache thread).
- Until patched, keep Node.js Thrift services off untrusted networks and behind a reverse proxy or firewall.
- Check each Linux distribution's advisory for its fixed package version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread 1 lists.apache.org
- Apache mailing list thread 2 lists.apache.org
- OSV: DEBIAN-CVE-2026-94646 osv.dev
- OSV: BIT-thrift-2026-94646 osv.dev
- OSV: BIT-thrift-2026-86536 (sibling advisory) osv.dev
- Vulners: CVE-2026-94646 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:54.
Original description (NVD)
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.