Which versions of Apache Thrift are affected by EUVD-2026-26026?

Apache Thrift Node.js library versions prior to the fix are vulnerable to remote denial of service attacks through uncontrolled recursion in message deserialization, allowing unauthenticated…. A patch is available.

How to fix or mitigate EUVD-2026-26026?

Within 24 hours: Identify all Node.js applications using Apache Thrift and document current versions in use; consult Apache Thrift release notes and security advisories for patched version availability and ETA. Within 7 days: Monitor Apache Thrift project repository and security channels (oss-security mailing list, NVD) for patch release; prepare testing environment with candidate patched version. Within 30 days: Apply vendor-released patch to all Thrift Node.js deployments following change management procedures; validate application functionality post-patch in staging before production rollout.

Apache Thrift EUVD-2026-26026

Q: What is the CVSS score of EUVD-2026-26026?

EUVD-2026-26026 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41636 HIGH

Uncontrolled Recursion (CWE-674)

2026-04-28

GHSA-r67j-r569-jrwp

Buffer Overflow Apache Node.js Red Hat Suse

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 28, 2026 - 18:38 nvd

Patch available

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Patch available

Apr 28, 2026 - 11:01 EUVD

Analysis Generated

Apr 28, 2026 - 10:22 vuln.today

CVSS changed

Apr 28, 2026 - 10:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 00:45 euvd

EUVD-2026-26026

Analysis Generated

Apr 28, 2026 - 00:45 vuln.today

CVE Published

Apr 28, 2026 - 00:45 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

305 npm packages depend on thrift (8 direct, 297 indirect)

Ecosystem-wide dependent count for version 0.23.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Uncontrolled recursion in Apache Thrift Node.js library's skip() function enables remote denial of service via crafted protocol messages. Attacker sends specially-crafted Thrift messages triggering deep recursion in the skip() deserialization routine, exhausting stack memory and crashing the Node.js process. CVSS 8.7 High severity with network attack vector requiring no authentication. Disclosed via oss-security mailing list on 2026-04-28 alongside three related Thrift vulnerabilities (C++ JSON OOB read CVE-2026-41607, c_glib dispatch stack overflow CVE-2026-41606, Swift Compact Protocol issue CVE-2026-41605), suggesting coordinated security audit results. EPSS data not yet available for 2026 CVE.

Technical ContextAI

Apache Thrift is a cross-language RPC framework using binary serialization protocols. The Node.js implementation includes a skip() function in its protocol deserialization layer, used to skip over unknown or unwanted fields during message parsing. CWE-674 (Uncontrolled Recursion) indicates the skip() function lacks proper recursion depth controls when processing nested data structures. In Thrift's binary protocols, container types (lists, sets, maps, structs) can be arbitrarily nested-legitimate use cases exist for several levels, but malicious messages with hundreds or thousands of nested containers trigger recursive skip() calls. Node.js V8 engine has limited call stack size (typically 10-15KB), making it particularly vulnerable to stack exhaustion attacks. The vulnerability affects the core protocol parsing layer, meaning any Node.js application using Apache Thrift for deserialization is potentially vulnerable regardless of the specific RPC service implementation.

RemediationAI

Upgrade to patched Apache Thrift version per Apache Security Advisory at lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql (specific fix version not confirmed in pre-NVD data-check advisory for Node.js library version). Workaround if patching is delayed: implement message size limits and deserialization timeouts at the application layer to detect and terminate abnormally slow parsing operations, typically by wrapping Thrift deserialization calls with Promise.race() using a timeout (e.g., 5-10 seconds) and enforcing maximum message size (e.g., 10MB) at the transport layer before deserialization begins-note this prevents processing of legitimately large messages and adds latency overhead. Network-level mitigation: restrict Thrift service endpoints to trusted IP ranges via firewall rules or VPC security groups to eliminate untrusted attacker access, though this does not protect against insider threats or compromised clients. For critical public-facing services, consider deploying a rate-limiting reverse proxy to throttle requests per source IP, reducing DoS amplification potential-aware this impacts legitimate high-volume clients and requires tuning per workload.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

8.8

CVE-2019-9543 HIGH POC

8.8

CVE-2019-9144 HIGH POC

8.8

CVE-2019-9143 HIGH POC

8.8

CVE-2026-9769 HIGH POC

8.7

CVE-2026-40345 HIGH POC

8.2

CVE-2025-9624 HIGH POC

8.3

CVE-2019-9192 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

EUVD-2026-26026 vulnerability details – vuln.today

Back

Apache Thrift EUVD-2026-26026

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-674 – Uncontrolled Recursion

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code