Description
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An uncaught exception in the Apache Thrift Node.js bindings causes the Thrift server process to terminate whenever a per-connection error occurs, or when one of two other triggers is activated. The flaw originates from improper validation of input quantities and uncontrolled modification of an object's prototype, leading to a server crash and a disruption of service for legitimate clients. The weakness is associated with CWE-1284, CWE-1321, CWE-248, and CWE-915.

Affected Systems

The vulnerability affects Apache Thrift version releases prior to 0.25.0, as distributed by the Apache Foundation.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog, suggesting limited evidence of exploitation but no proof of it being mitigated. The likely attack vector involves an attacker sending input that triggers the per-connection error; while the description does not explicitly state that any remote client can do so, it is inferred that an external client capable of establishing a Thrift connection may provoke the bug and cause the server to terminate, leading to repeated service interruptions.

Generated by OpenCVE AI on October 3, 2026 at 01:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to v0.25.0 or newer to apply the fix for the process termination bug.
  • Restart the affected services after the upgrade so the new bindings are loaded and the crash condition is removed.
  • Configure monitoring or a process supervisor to detect unexpected server termination and automatically restart the service as a temporary resilience measure.

Generated by OpenCVE AI on October 3, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-915
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Fri, 02 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
Weaknesses CWE-1284
CWE-1321
CWE-248
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T13:50:57.551Z

Reserved: 2026-09-21T23:13:28.097Z

Link: CVE-2026-94646

cve-icon Vulnrichment

Updated: 2026-10-02T13:50:51.931Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T12:17:23.587

Modified: 2026-10-02T14:30:28.440

Link: CVE-2026-94646

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-02T11:52:21Z

Links: CVE-2026-94646 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-03T01:30:18Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-248

    Uncaught Exception

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes