A flaw was found in Apache Thrift's Node.js bindings. Due to improper input validation and prototype pollution—a condition where base JavaScript object properties can be modified—the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending specially crafted input to trigger an uncaught exception, causing the service to crash and resulting in a Denial of Service (DoS).
Last checked: 2026-10-02 16:48 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-02 13:50 UTC)
Fix evidence last checked: 2026-10-02 22:13 UTC