CVE-2026-41636
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Apr 28, 2026
CISA due date
—
The record
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | thrift | 0 | 0.23.0 |
| openSUSE:Tumbleweed | thrift | 0 | 0.23.0-1.1 |
Related vulnerabilities
- GHSA-r67j-r569-jrwp Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion Same vulnerability
- GHSA-526f-jxpj-jmg2 Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled… Also affects thrift
- CVE-2026-43870 Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory… Also affects thrift
- CVE-2026-41605 Integer Overflow or Wraparound vulnerability in Apache Thrift. Also affects thrift
- CVE-2026-41607 Out-of-bounds Read vulnerability in Apache Thrift. Also affects thrift
- CVE-2026-41604 Out-of-bounds Read vulnerability in Apache Thrift. Also affects thrift
- CVE-2026-41606 Uncontrolled Recursion vulnerability in Apache Thrift. Also affects thrift
- CVE-2026-41602 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go… Also affects thrift