Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang… (CVE-2026-83745)

The vulnerability in Apache Thrift's Node.js and D language bindings involves improper handling of the length parameter in WebSocket server transports. The transports read the payload length from the frame header and allocate memory accordingly without verifying that the full payload has arrived. This allows an attacker to send a small frame that declares a very large payload size, causing excessive memory allocation. In Node.js, the connection remains open after such a frame, allowing repeated exploitation. This affects versions prior to 0.25.0, which includes multiple specific versions listed. The issue is resolved by upgrading to Apache Thrift 0.25.0.

An attacker can cause the server to allocate excessive memory by sending a small WebSocket frame with a large declared payload length. This can lead to resource exhaustion, potentially causing denial of service due to memory exhaustion. The Node.js binding's behavior of keeping the connection open allows repeated exploitation, increasing the impact. No privilege escalation or code execution is described.

Upgrade Apache Thrift to version 0.25.0 or later, which fixes the improper handling of the length parameter and prevents excessive memory allocation. No other mitigation or temporary fix is indicated.