Executive brief
Apache Thrift is an open-source framework used by many applications to serialize and transmit data between services. The Node.js version contains a flaw that allows attackers to trigger uncontrolled recursion, causing the application to consume excessive memory and CPU resources and eventually crash, resulting in a denial-of-service attack against dependent services.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in Apache Thrift's Node.js bindings, affecting all versions before 0.23.0. An attacker can craft malicious Thrift protocol input that triggers recursive processing without proper depth limits, exhausting stack memory and causing the process to crash. This is a network-reachable vulnerability with no authentication required; any client capable of sending data to a Thrift service is a potential attacker. The impact is denial-of-service through application crash or hang. The fix is available in Apache Thrift version 0.23.0 and later.
Affected products
- Apache Thrift before 0.23.0
Timeline
- 2026-04-28: disclosed: Published on GitHub Advisory Database and NVD
- 2026-04-28: patched: Fixed in version 0.23.0