CVE-2026-43870 — Apache Thrift: Node.js web_server.js multi-vulnerability

Description (CNA)

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.23.0

CWE

CWE-346, CWE-22, CWE-113, CWE-400

References

https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/05/05/4

CISA-ADP

No English description supplied.

No references supplied.