Vulnerability · Published Oct 2, 2026 · Assigned by apache

CVE-2026-94646Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

High 8.7

In plain English

A high-severity prototype pollution in Apache Thrift from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	thrift	no fix listed	DEBIAN-CVE-2026-94646
Debian:13	thrift	no fix listed	DEBIAN-CVE-2026-94646
Debian:14	thrift	no fix listed	DEBIAN-CVE-2026-94646
Ubuntu:22.04:LTS	thrift	no fix listed	UBUNTU-CVE-2026-94646
Ubuntu:24.04:LTS	thrift	no fix listed	UBUNTU-CVE-2026-94646
Ubuntu:26.04:LTS	thrift	no fix listed	UBUNTU-CVE-2026-94646
Ubuntu:26.10	thrift	no fix listed	UBUNTU-CVE-2026-94646

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Thrift	0 – before 0.25.0

Weakness: CWE-248, CWE-1284, CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 vendor-advisory
https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8 vendor-advisory