Apache Thrift’s Node.js bindings contain an uncontrolled recursion flaw in the skip() method. Malicious input can force the method to recurse without an adequate termination condition, exhausting stack space and causing the process to crash. The impact is a denial‑of‑service because the affected Thrift service or client becomes unavailable. The weakness corresponds to CWE‑674 – Uncontrolled Recursion.

Apache Software Foundation’s Apache Thrift implementation before version 0.23.0 is vulnerable. Any deployment that uses the Node.js bindings of those versions is affected.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. The likely attack vector is remote, via crafted Thrift requests sent to the server or during client data deserialization. An attacker would need to supply input that triggers the bad skip call to force a stack overflow and crash the process.