Apache Software FoundationCVE-2026-94646

Apache Thrift: prototype pollution

High8.7CVE-2026-94646 · Published Oct 2, 2026

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache Thrift Product	< 0.25.0	0.25.0

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-248, CWE-1284, CWE-1321

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946550.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946560.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946570.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-946540.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-854760.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: integer overflow Critical9.2Oct 2 CVE-2026-836320.25.0	Critical9.2	0.25.0