Apache Thrift’s Node.js bindings contain an uncontrolled recursion flaw. This weakness can be triggered by malicious input that causes the code to recurse without an adequate termination condition, exhausting stack space and terminating the process. The result is a denial‑of‑service where the affected Thrift service or client becomes unavailable. The vulnerability is identified by CWE‑674 and CWE‑776.

Apache Software Foundation’s Apache Thrift implementation prior to version 0.23.0 that uses the Node.js bindings is vulnerable. Any deployment employing those versions runs the risk of exploitation.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that widespread exploitation has not been observed so far. The likely attack vector is remote: an attacker can send crafted Thrift requests to trigger the recursion, forcing a stack overflow and crashing the process.