Apache Thrift CVE-2026-96294

Exploitable against any service that uses the Apache Thrift Node.js bindings at a version before 0.25.0 and accepts Thrift protocol messages over the network; the attacker must be able to reach the Thrift listener and send a crafted/malformed message that triggers the unhandled exception. Per the vendor CVSS vector (PR:N/UI:N/AC:L/AT:N) no authentication, no user interaction, and no special attack prerequisites are required. The principal limiting factor is network exposure: services that only accept Thrift traffic from trusted internal peers or behind authentication/proxy layers face substantially lower real-world risk, and only the Node.js language bindings are affected (other-language Thrift bindings are out of scope).

All available impact signals point to a denial-of-service vulnerability, not a code-execution or data-exposure flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 but derives its entire weight from VA:H (availability) with VC/VI set to N, which is fully consistent with the CWE-248 (Uncaught Exception) / Improper Handling of Exceptional Conditions root cause: a crafted message can trigger an unhandled exception that crashes the Node.js process. The 'Information Disclosure' tag in the input CONFLICTS with the CVSS vector, which explicitly sets confidentiality impact to none (VC:N) - this tag appears mislabeled and should not be treated as evidence of data exposure. No EPSS score, KEV listing, or POC indicator was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuinely network-reachable, unauthenticated, low-complexity DoS in a popular RPC framework is a real patching priority for exposed Thrift/Node services, but it is not a confidentiality/integrity emergency - the high CVSS is driven solely by availability. Because a single unhandled exception in Node.js typically terminates the entire event-loop process, the availability impact rating is credible.

An attacker sends a malformed or unexpected Thrift protocol message to a network-exposed service built on the Apache Thrift Node.js bindings. The improperly handled exception propagates as an uncaught error, crashing the Node.js process and denying service to all clients. No authentication or user interaction is required, but no public proof-of-concept was provided in the input.