CVE-2026-94645 — Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

CVE-2026-94645

Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound PUBLISHED

Description (CNA)

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.25.0

CWE

CWE-1284, CWE-770

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.