Apache Thrift Node.js bindings: Denial of service via uncaught exception
Summary
The Node.js bindings of Apache Thrift do not attach an error listener to upgraded WebSocket connections, so an exception on such a connection is not handled. A remote, unauthenticated attacker can crash the Node.js process that serves a Thrift WebSocket endpoint, causing a denial of service. Exploitation requires that such an endpoint is reachable by the attacker.
Affected
- Apache Thrift before 0.25.0 (range 0 to below 0.25.0)
- Affected component: Node.js bindings (npm package "thrift")
- Distribution builds: Azure Linux 0.25.0-1 is the fixed build; Red Hat Hardened Images 0.25.0-0.1.hum1 is the fixed build
Fixed in
- Upgrade to Apache Thrift 0.25.0 or later
- Distribution packages: check your vendor for the fixed build (Azure Linux 0.25.0-1, Red Hat Hardened Images 0.25.0-0.1.hum1)
Workaround
- Unknown. No workaround is listed in the sources.
- Interim measure (not vendor-sourced): restrict access to the Node.js Thrift WebSocket endpoint, for example with firewall rules or an authenticated reverse proxy, until the upgrade is done.
Exploitation
- No known exploitation in the wild in the consulted sources. CISA KEV was not checked directly.
- No public exploit code is confirmed.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify Node.js services that use Apache Thrift and check whether they expose a WebSocket endpoint to untrusted networks.
- Upgrade Apache Thrift to 0.25.0 or later. This also covers CVE-2026-83745 (memory exhaustion in the WebSocket frame decoders).
- If an upgrade is delayed, restrict access to the endpoint and check that WebSocket connections have error handlers.
- Monitor service availability and restarts of the Node.js process.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread 1 lists.apache.org
- Apache Thrift mailing list thread 2 lists.apache.org
- OSV: CVE-2026-96294 osv.dev
- OSV: BIT-thrift-2026-96294 (Bitnami) osv.dev
- Vulners: CVELIST:CVE-2026-96294 vulners.com
- Vulners: Red Hat RHSA-2026:74369-CVE-2026-96294 vulners.com
- OSV: BIT-thrift-2026-83745 (related CVE) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:53.
Original description (NVD)
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.