Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-96294: Apache Thrift NodeJS can crash, stopping service
CVE-2026-96294 · published 1 month ago
Summary
The NodeJS code used by Apache Thrift may hit an unexpected error and terminate, which can halt any applications that rely on it. This affects versions of Apache Thrift released before version 0.25.0. Update the Thrift package to version 0.25.0 or later to prevent the crash.
What to do
- Update apache software foundation apache thrift to version 0.25.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache thrift | < 0.25.0 |
| Debian:12 | debian | thrift | All versions |
| Ubuntu:20.04:LTS | canonical | thrift | All versions |
Original advisory text
DEBIAN-CVE-2026-96294
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
References
- https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4 Third Party Advisory
- https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-96294 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-96294 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-96294 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-248Uncaught Exception
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published2 Oct 2026
Updated3 Nov 2026
First seen2 Oct 2026
Sources
CVE-2026-96294 · NVD
CVE-2026-96294 · MITRE
DEBIAN-CVE-2026-96294 · OSV
UBUNTU-CVE-2026-96294 · OSV
Track software like this
Free during beta