Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. (CVE-2026-86536)
Description
A prototype pollution vulnerability exists in Apache Thrift's JavaScript bindings before version 0.25.0. This flaw allows improper modification of object prototype attributes, which can lead to unexpected behavior in applications using affected versions. The issue is resolved by upgrading to version 0.25.0 and regenerating JavaScript code.
CVSS v4.0
Affected software
pkg:deb/ubuntu/thrift?arch=source&distro=focalpkg:deb/ubuntu/thrift?arch=source&distro=jammypkg:deb/ubuntu/thrift?arch=source&distro=noblepkg:deb/ubuntu/thrift?arch=source&distro=stonkingpkg:deb/ubuntu/thrift?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86536 describes a prototype pollution vulnerability in all JavaScript bindings of Apache Thrift versions prior to 0.25.0. Prototype pollution occurs when an attacker can modify the prototype of a base object, potentially altering the behavior of all objects inheriting from it. This vulnerability affects multiple specific versions of Apache Thrift's JavaScript bindings as listed. The recommended remediation is to upgrade to version 0.25.0 and regenerate the JavaScript code, which addresses the issue.
Potential Impact
The vulnerability allows attackers to improperly modify object prototype attributes in affected Apache Thrift JavaScript bindings. This can cause unexpected application behavior, potentially leading to security issues such as data corruption or logic errors. However, there are no known exploits in the wild, and the CVSS vector indicates a medium severity with no privileges required and no user interaction needed.
Mitigation Recommendations
Users should upgrade Apache Thrift to version 0.25.0 and regenerate their JavaScript code to fix the prototype pollution vulnerability. No alternative mitigations are indicated. Patch status is confirmed by the vendor recommendation to upgrade.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-86536
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f54e2cdf04f6566586a1
Added to database: 10/17/2026, 22:23:10 UTC
Last enriched: 10/17/2026, 23:23:44 UTC
Last updated: 10/17/2026, 23:23:44 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.