CVE-2026-86535 describes a security flaw in Apache Thrift's NodeJS bindings using TJSONProtocol, where an infinite loop occurs because of a loop with an unreachable exit condition. Additionally, the vulnerability includes improper control over modification of object prototype attributes, known as prototype pollution. This can lead to unexpected behavior or potential security risks in applications using affected versions of Apache Thrift prior to 0.25.0. The issue is resolved in version 0.25.0.

The vulnerability can cause denial of service through an infinite loop and may allow attackers to manipulate object prototype attributes, potentially leading to security breaches such as privilege escalation or arbitrary code execution depending on the application context. The severity is high due to the combination of denial of service and prototype pollution risks.

Users should upgrade Apache Thrift to version 0.25.0 or later, where this vulnerability is fixed. No other mitigation steps are indicated or required.