Apache Thrift versions prior to 0.25.0 contain a vulnerability in the Node.js and D language bindings' WebSocket server transports. These transports read the payload length from the frame header and allocate memory immediately without verifying that the full payload has arrived. This flaw allows a small frame (approximately 14 bytes) to cause the server to allocate an excessive amount of memory (up to 513 MiB on Node.js and 2 GiB on D transport). In the Node.js case, the connection remains open, allowing repeated exploitation. The vulnerability is addressed by upgrading to version 0.25.0.

An attacker can cause the affected Apache Thrift WebSocket servers to allocate excessive memory, leading to resource exhaustion and potential denial of service. The Node.js binding is particularly vulnerable as it keeps the connection open after the attack frame, enabling repeated exploitation. This can disrupt service availability and degrade system performance.

Users should upgrade Apache Thrift to version 0.25.0 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.