Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion

ALTO 7.5CVE-2026-41636 · BIT-thrift-2026-41636 · GHSA-r67j-r569-jrwp · Published 28/04/2026 · updated 26/10/2026

In breve

CVE-2026-41636 è una vulnerabilità ALTO (CVSS 7.5) che riguarda thrift (apache), thrift.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.45%, superiore al 39.2% delle vulnerabilità.
Correzione: aggiornare a 0.23.0 o successiva.

Package	Affected versions	Patched versions
thrift apache	`< 0.23.0`	`0.23.0`
thrift npm	`< 0.23.0`	`0.23.0`

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

NVD description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2026-41636 · ADVISORY
apache/thrift · PACKAGE
lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql · WEB
openwall.com/lists/oss-security/2026/04/28/1 · WEB

Altre vulnerabilità di thrift

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

thrift

apache

< 0.23.0

0.23.0

thrift

npm

< 0.23.0

0.23.0

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

NVD description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Altre vulnerabilità di thrift

Vedi tutto →