Apache Thrift CVE-2026-86536

Exploitation requires an application that uses Apache Thrift's generated JavaScript bindings (versions before 0.25.0) to deserialize attacker-influenced input, so the JS code generator/runtime must be in the data path. The CVSS AT:P (attack requirements present) indicates success is not guaranteed under all configurations - it depends on the application consuming untrusted Thrift messages and on object properties being reachable for prototype manipulation. Limiting factors: only deployments using the JS bindings specifically are affected (not C++, Java, Python, etc.), the service must process externally-controlled serialized data, and impact is confined to integrity (VI:L) with no direct confidentiality or availability loss. The fix also requires re-generating JS code after upgrading to 0.25.0, so simply bumping the library version without regeneration leaves code vulnerable.

This is a medium-severity prototype pollution flaw (CWE-1321) in the JavaScript bindings of Apache Thrift, carrying a vendor-assigned CVSS 4.0 base score of 6.3. The vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) indicates network-reachable, unauthenticated exploitation of relatively low complexity, but note the AT:P flag - the attack has specific preconditions (it is not a universal push-button exploit) - and impact is limited to integrity only (VI:L), with no confidentiality or availability impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: the modest score, integrity-only impact, and required attack conditions all point to a genuine but lower-tier issue rather than a drop-everything emergency. One tension worth flagging: the 'Information Disclosure' tag conflicts with the CVSS vector, which sets VC:N (no confidentiality impact) - prototype pollution here is an integrity problem, so the disclosure framing appears inaccurate. Prioritize patching as routine hygiene for teams using the JS bindings, especially where polluted prototypes could cascade into more severe downstream behavior (e.g., DoS or logic bypass) within a given application.

An attacker sends crafted serialized Thrift data over the network to a Node.js/JavaScript service that deserializes input using vulnerable Thrift JS bindings. Specially-named keys modify the Object prototype, corrupting application-wide object attributes and tampering with downstream logic. No public exploit code was identified, and the attack requires conditions beyond a default trivial case (CVSS AT:P).