What is the CVSS score of CVE-2026-43870?

CVE-2026-43870 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Apache Thrift are affected by CVE-2026-43870?

Apache Thrift Node.js versions prior to 0.23.0 contain a path traversal vulnerability allowing unauthenticated remote attackers to read sensitive files and write to arbitrary locations, potentially…. A patch is available.

How to fix or mitigate CVE-2026-43870?

Within 24 hours: Identify all systems running Apache Thrift Node.js and document current versions via inventory tools. Within 7 days: Apply vendor-released patch to upgrade all affected instances to version 0.23.0 or later, with priority given to internet-facing deployments. Within 30 days: Conduct file system access audit on patched systems to detect any unauthorized file reads or writes during the exposure window.

Apache Thrift CVE-2026-43870

EUVD-2026-27245 HIGH

Path Traversal (CWE-22)

2026-05-05

GHSA-526f-jxpj-jmg2

Apache Java Path Traversal Node.js

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 17:30 vuln.today

CVSS changed

May 06, 2026 - 15:22 NVD

7.3 (None) 7.3 (HIGH)

Patch available

May 05, 2026 - 10:01 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on thrift (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.22.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal vulnerability in Apache Thrift Node.js web_server.js (versions prior to 0.23.0) allows remote unauthenticated attackers to read arbitrary files, write to unauthorized locations, and potentially execute code. Disclosed via oss-security mailing list pre-NVD publication. EPSS score of 0.01% indicates low observed exploitation probability despite network-accessible attack vector and no authentication requirement. CISA SSVC framework classifies this as automatable with partial technical impact but no confirmed exploitation. Patch available in version 0.23.0.

Technical ContextAI

Apache Thrift is a cross-language RPC framework supporting multiple programming languages including Node.js, Java, and Rust. This vulnerability affects the Node.js implementation's web_server.js component, classified as CWE-22 (Path Traversal). Path traversal flaws occur when applications use external input to construct file paths without proper validation, allowing attackers to use sequences like '../' to escape intended directories. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no privileges required. The multi-vulnerability designation in the oss-security disclosure suggests web_server.js may contain multiple related security issues beyond just path traversal. Affected CPE appears to be Apache Thrift versions 0 through 0.22.x, with fix delivered in 0.23.0.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later, which contains vendor-released patches for this vulnerability per EUVD-2026-27245. Consult Apache advisory at https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy for complete upgrade instructions and changelog. If immediate patching is not feasible, implement compensating controls specific to path traversal: configure web_server.js to run with minimal filesystem permissions using principle of least privilege, restricting read/write access to only required directories; deploy web application firewall (WAF) rules to block requests containing path traversal sequences (../, ..\ , URL-encoded variants %2e%2e%2f); disable web_server.js component entirely if not required for application functionality; if web server must remain active, place behind reverse proxy with strict path validation and chroot jail to contain filesystem access. Note that input validation alone may be insufficient as attackers use encoding tricks to bypass filters-defense-in-depth with filesystem permissions and containerization provides more reliable protection. Review application logs for historical exploitation attempts showing unusual file access patterns.