Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion

높음 7.5CVE-2026-41636 · BIT-thrift-2026-41636 · GHSA-r67j-r569-jrwp · Published 28/04/2026 · updated 26/10/2026

요약

CVE-2026-41636은(는) thrift (apache), thrift에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.45%, 전체 취약점의 39.2%보다 높음.
조치: 0.23.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
thrift apache	`< 0.23.0`	`0.23.0`
thrift npm	`< 0.23.0`	`0.23.0`

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

NVD description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2026-41636 · ADVISORY
apache/thrift · PACKAGE
lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql · WEB
openwall.com/lists/oss-security/2026/04/28/1 · WEB

thrift의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

thrift

apache

< 0.23.0

0.23.0

thrift

npm

< 0.23.0

0.23.0

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

NVD description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

thrift의 다른 취약점

모두 보기 →