CVE-2026-86535

high

Description

Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

References

Advisories
More

https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91452

Details

Source: Mitre, NVD

Published: 2026-10-02

Updated: 2026-10-02

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.0034