Apache Thrift Node.js bindings contain an inefficient receive transport logic that scales quadratically with the size of incoming data; this leads to excessive memory allocation and execution time when a client sends a specially crafted payload. The result is an application‑level denial of service that can exhaust system resources, halt the server process, and deny legitimate traffic.

Apache Software Foundation’s Apache Thrift, specifically all Node.js bindings released before 0.24.0, are affected. Users running any of these versions and exposing a Thrift server to external clients are vulnerable.

The vulnerability carries a CVSS score of 8.7, indicating a high severity condition. The EPSS score of 1% indicates a low but nonzero exploitation probability, and the flaw is not listed in CISA’s KEV catalog, suggesting it may not yet have widespread exploitation. The likely attack vector involves a remote client transmitting malformed or oversized data to the Thrift server, triggering the quadratic resource consumption and causing a denial of service. Successful exploitation could lead to loss of service availability for impacted systems and services.