CVE-2026-94646

high

Description

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

References

Advisories
More

https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91563

Details

Source: Mitre, NVD

Published: 2026-10-02

Updated: 2026-10-02

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.0046