Threats affecting pkg:npm/thrift

CVE-2026-94646 is a high-severity vulnerability in Apache Thrift's Node.js bindings affecting versions before 0.25.0. It involves uncaught exceptions, improper validation of input quantities, and prototype pollution due to improperly controlled modification of object prototype attributes. This vulnerability can lead to significant security risks if exploited. Users are advised to upgrade to version 0.25.0, which addresses and fixes the issue.

CVE-2026-86535 is a high-severity vulnerability in Apache Thrift NodeJS bindings involving an infinite loop caused by a loop with an unreachable exit condition and prototype pollution. This affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade.

CVE-2026-96294 is a high-severity vulnerability in Apache Thrift's NodeJS bindings caused by uncaught exceptions and improper handling of exceptional conditions. This flaw affects all versions before 0.25.0. The issue has been fixed in Apache Thrift version 0.25.0. Users should upgrade to this version to remediate the vulnerability.

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.

CVE-2026-94645 is a high-severity vulnerability in Apache Thrift's Node.js bindings involving improper validation of specified quantity in input, leading to allocation of resources without limits or throttling. This flaw affects all versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Apache Thrift versions before 0.23.0 are affected by multiple vulnerabilities including path traversal, HTTP request/response splitting, and uncontrolled resource consumption. These issues allow attackers to manipulate file paths, inject CRLF sequences in HTTP headers, and potentially exhaust system resources. The vulnerabilities have a high severity score of 7.3 CVSS v3.1. Users should upgrade to version 0.23.0 to address these flaws.

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.