Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-41636: Apache Thrift Node.js may cause server crash
CVE-2026-41636 · published 6 months ago
Summary
The Node.js version of Apache Thrift can get stuck in an endless loop, which could make your service stop responding. This affects Apache Thrift versions before 0.23.0. Update to version 0.23.0 to stop the problem.
What to do
- Update thrift to version 0.23.0.
- Update debian thrift to version 0.23.0-3.
- Update apache thrift to version 0.23.0 or later.
- Update apache software foundation apache thrift to version 0.23.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache | thrift |
< 0.23.0 cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:* |
| Debian:11 | debian | thrift | All versions |
| Debian:12 | debian | thrift | All versions |
| Debian:13 | debian | thrift | All versions |
| Debian:14 | debian | thrift |
< 0.23.0-3 Fix: upgrade to 0.23.0-3
|
| Bitnami | – | thrift |
< 0.23.0 Fix: upgrade to 0.23.0
|
| Ubuntu:20.04:LTS | canonical | thrift | All versions |
| – | apache software foundation | apache thrift | < 0.23.0 |
Original advisory text
Apache Thrift: Node.js skip() recursion
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
References
- https://security-tracker.debian.org/tracker/CVE-2026-41636 Vendor Advisory
- https://github.com/advisories/GHSA-r67j-r569-jrwp
- https://github.com/apache/thrift Product
- https://ubuntu.com/security/CVE-2026-41636 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41636 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2026/04/28/1 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/28/1 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41636... Vendor Advisory
- https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41636 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-674Uncontrolled Recursion
Timeline
Published28 Apr 2026
Updated4 Nov 2026
First seen28 Apr 2026
Sources
DEBIAN-CVE-2026-41636 · OSV
CVE-2026-41636 · NVD
BIT-thrift-2026-41636 · OSV
GHSA-r67j-r569-jrwp · GHSA
GHSA-r67j-r569-jrwp · OSV
CVE-2026-41636 · OSV
UBUNTU-CVE-2026-41636 · OSV
CVE-2026-41636 · MITRE
Track software like this
Free during beta