CVE-2026-94646CWE-1284CWE-1321CWE-248

CVE-2026-94646

published October 2, 2026

CVSS
8.7
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00460 · 38.9th percentile
Weaknesses
CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-248 · Uncaught Exception
Published
2026-10-02T16:17Z
References (2)
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 · [email protected]https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:52Z
    Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
    cvelistv5